Identity Plugin by atpugtihsrah · Pull Request #288 · containerd/nri

atpugtihsrah · 2026-04-24T07:11:39Z

Identity Plugin WIP

RFC PR: #245

Relates to #240

PR Assisted by IBM Bob.

MikeZappa87 · 2026-05-07T19:02:51Z

@atpugtihsrah this is interesting. I did some work in the istio/isovalent ecosystem for SPIRE. Lmk if you need any help

mikebrow · 2026-07-14T14:26:31Z

Ginkgo detected a version mismatch between the Ginkgo CLI and the version of Ginkgo imported by your packages:
  Ginkgo CLI Version:
    2.28.1
  Mismatched package versions found:
    2.19.1 used by identity-injector

  Ginkgo will continue to attempt to run but you may see errors (including flag
  parsing errors) and should either update your go.mod or your version of the
  Ginkgo CLI to match.

  To install the matching version of the CLI run
    go install github.com/onsi/ginkgo/v2/ginkgo
  from a path that contains a go.mod file.  Alternatively you can use
    go run github.com/onsi/ginkgo/v2/ginkgo
  from a path that contains a go.mod file to invoke the matching version of the
  Ginkgo CLI.

  If you are attempting to test multiple packages that each have a different
  version of the Ginkgo library with a single Ginkgo CLI that is currently
  unsupported.

mikebrow · 2026-07-20T19:58:41Z

good meeting this morning @atpugtihsrah! Note to other reviewers contributor is going to clean up the vendor issues and boost the plugin getting started guide.

mikebrow · 2026-08-20T22:26:28Z

heads up needs rebase :-) we've been busy getting ready for a release

mikebrow · 2026-09-01T21:00:04Z

Ran the test instructions to success using kind...

We can add this later:
mikebrow@76915f1

mikebrow

LGTM very nice...

would like to get this in and iterate

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Adds a WIP “Identity Plugin” (identity-injector) to fetch X.509 SVIDs via SPIRE’s Delegated Identity API and inject them into workload containers, along with kustomize manifests and a local-cluster setup guide.

Changes:

Introduces the identity-injector plugin implementation (gRPC streaming watchers, file writes, annotation parsing) and a unit test for annotation parsing.
Adds kustomize base/overlay resources to deploy the plugin as a DaemonSet.
Adds a detailed setup guide for SPIRE/SPIFFE + local build/test flow, and wires the plugin tests into the main Makefile.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
plugins/identity-injector/identity-injector.go	Implements the identity-injector plugin, certificate/bundle streaming watchers, and annotation parsing.
plugins/identity-injector/identity-injector_test.go	Adds unit tests for parsing identity annotations.
plugins/identity-injector/go.mod	Defines the plugin module and dependencies (SPIFFE/SPIRE SDK, gRPC, yaml, etc.).
plugins/identity-injector/go.sum	Locks dependency checksums for the plugin module.
contrib/kustomize/identity-injector/kustomization.yaml	Adds a kustomize entry point for the identity-injector deployment.
contrib/kustomize/identity-injector/base/kustomization.yaml	Defines base resources, image override, and common labels for deployment.
contrib/kustomize/identity-injector/base/daemonset.yaml	Adds the DaemonSet manifest to run the plugin and mount required host paths/sockets.
plugins/identity-injector/setup.md	Documents end-to-end local setup for SPIRE + plugin + test workload.
Makefile	Adds a test target for the new identity-injector plugin.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+
+}
+
+// TODO create test cases for processDelegatedIdentityUpdate()


+sudo mkdir /tmp/spire-data
+
+sudo chmod 777 /tmp/spire-data


+sudo mkdir /var/run/spiffe/
+sudo mkdir /var/run/spiffe/secrets/
+sudo chmod 777 /var/run/spiffe/secrets/


mikebrow

maybe a little more work around the map initialization part to ensure it's never used when not properly initialized

Signed-off-by: Harshit Gupta <hg2t4e@gmail.com>

Copilot

🟡 Changes recommended

Request-lifetime cancellation, unsafe filename handling, startup races, and missing recovery paths currently prevent reliable and secure identity delivery.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

plugins/identity-injector/identity-injector.go:372

The bundle stream has the same permanent-failure path: any transient Recv error returns, cancels the shared context, and stops SVID rotation too. Re-establish this subscription with bounded backoff while the container watcher remains active.

			resp, err := stream.Recv()
			if err != nil {
				log.Errorf("%s: bundle stream error: %v", containerName(pod, ctr), err)
				return

Files reviewed: 8/9 changed files
Comments generated: 9
Review effort level: Balanced

+            - "--verbose"
+            - "true"


+	if err := p.startCertificateWatcher(ctx, pod, container, int32(container.Pid), hostDir, config); err != nil {
+		return fmt.Errorf("failed to start certificate watcher: %w", err)
+	}
+
+	return nil


+	p.watchersMu.RUnlock()
+
+	// Create cancellable context for this watcher
+	watcherCtx, cancel := context.WithCancel(ctx)


+	if config.CertFileName == "" {
+		config.CertFileName = defaultCertFileName
+	}
+	if config.KeyFileName == "" {
+		config.KeyFileName = defaultKeyFileName
+	}
+	if config.BundleFileName == "" {
+		config.BundleFileName = defaultBundleFileName
+	}
+
+	return &config, nil


 #

-test-gopkgs: go-generate test-main test-ulimits test-rdt test-hook-injector test-writable-cgroups
+test-gopkgs: go-generate test-main test-ulimits test-rdt test-hook-injector test-writable-cgroups test-identity-injector


+			resp, err := stream.Recv()
+			if err != nil {
+				log.Errorf("%s: bundle stream error: %v", containerName(pod, ctr), err)
+				return


+	// TODO implement using hint to select relevant svid in case response has multiple svids
+	// Get the default SVID
+	svidWithKey := x509Svids[0]


+	p := &plugin{
+		watchers: make(map[string]*containerWatcher),


+
+## Step 2.2: Deploy the NRI Identity Plugin
+
+**Why:** The kustomize overlay in `contrib/kustomize/identity-injector/` contains all of the Kubernetes resources needed to run the NRI Identity Plugin as a DaemonSet in the `kube-system` namespace: the DaemonSet definition (which mounts the SPIRE admin socket and the SVID secrets directory), the NRI registration ConfigMap (so that the Containerd NRI runtime knows to invoke the plugin), and the necessary RBAC resources. Applying it as a single `kubectl apply -k` command ensures all resources are created in the correct order and with the correct labels.


atpugtihsrah mentioned this pull request Apr 24, 2026

Identity Plugin RFC #245

Draft

atpugtihsrah force-pushed the identity-plugin-5qjelc65nb branch from 11f5595 to ff81182 Compare May 21, 2026 14:48

atpugtihsrah force-pushed the identity-plugin-5qjelc65nb branch 2 times, most recently from 0748a95 to e355b5e Compare July 12, 2026 06:44

mikebrow reviewed Jul 14, 2026

View reviewed changes

Comment thread plugins/identity-injector/identity-injector_test.go Outdated

mikebrow reviewed Jul 14, 2026

View reviewed changes

Comment thread plugins/identity-injector/go.mod

atpugtihsrah force-pushed the identity-plugin-5qjelc65nb branch 10 times, most recently from 7b49520 to ec86027 Compare July 16, 2026 09:26

atpugtihsrah marked this pull request as ready for review July 16, 2026 09:29

mikebrow reviewed Jul 30, 2026

View reviewed changes

Comment thread plugins/identity-injector/setup.md Outdated

mikebrow reviewed Jul 30, 2026

View reviewed changes

Comment thread plugins/identity-injector/setup.md Outdated

atpugtihsrah force-pushed the identity-plugin-5qjelc65nb branch 2 times, most recently from cadcd8d to c3a1707 Compare July 31, 2026 08:31

atpugtihsrah force-pushed the identity-plugin-5qjelc65nb branch 2 times, most recently from b46ddf1 to 3358c45 Compare August 25, 2026 15:13

mikebrow approved these changes Sep 1, 2026

View reviewed changes

mikebrow requested a balanced review from Copilot September 1, 2026 21:22

MikeZappa87 reviewed Sep 1, 2026

View reviewed changes

Comment thread plugins/identity-injector/identity-injector.go

Copilot AI reviewed Sep 1, 2026

View reviewed changes

Copilot started reviewing on behalf of mikebrow September 1, 2026 21:53 View session

atpugtihsrah force-pushed the identity-plugin-5qjelc65nb branch 2 times, most recently from ca3b6ac to 189f5a6 Compare September 3, 2026 12:05

mikebrow reviewed Sep 3, 2026

View reviewed changes

Comment thread plugins/identity-injector/identity-injector.go Outdated

Comment thread plugins/identity-injector/identity-injector.go

Comment thread plugins/identity-injector/identity-injector.go

atpugtihsrah force-pushed the identity-plugin-5qjelc65nb branch 4 times, most recently from acc660c to d488f96 Compare September 4, 2026 07:24

identity plugin code

7f3b152

Signed-off-by: Harshit Gupta <hg2t4e@gmail.com>

atpugtihsrah force-pushed the identity-plugin-5qjelc65nb branch from d488f96 to 7f3b152 Compare September 4, 2026 07:35

mikebrow requested a balanced review from Copilot September 4, 2026 20:36

Copilot started reviewing on behalf of mikebrow September 4, 2026 20:37 View session

Copilot AI reviewed Sep 4, 2026

View reviewed changes


		}

		// TODO create test cases for processDelegatedIdentityUpdate()


		## Step 2.2: Deploy the NRI Identity Plugin

		Why: The kustomize overlay in `contrib/kustomize/identity-injector/` contains all of the Kubernetes resources needed to run the NRI Identity Plugin as a DaemonSet in the `kube-system` namespace: the DaemonSet definition (which mounts the SPIRE admin socket and the SVID secrets directory), the NRI registration ConfigMap (so that the Containerd NRI runtime knows to invoke the plugin), and the necessary RBAC resources. Applying it as a single `kubectl apply -k` command ensures all resources are created in the correct order and with the correct labels.

Uh oh!

Conversation

atpugtihsrah commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MikeZappa87 commented May 7, 2026

Uh oh!

Uh oh!

mikebrow commented Jul 14, 2026

Uh oh!

Uh oh!

mikebrow commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mikebrow commented Aug 20, 2026

Uh oh!

mikebrow commented Sep 1, 2026

Uh oh!

mikebrow left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mikebrow left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Suppressed comments (1)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

atpugtihsrah commented Apr 24, 2026 •

edited

Loading

mikebrow commented Jul 20, 2026 •

edited

Loading