Proposed Bundle Publisher destinations and formats

[azdagron]

Please comment below for others that should be considered.

• [ ] K8s Secret (PEM,JWKS,SPIFFE)
• [ ] K8s ConfigMap (PEM,JWKS,SPIFFE)
• [ ] K8s Webhook (PEM)
• [ ] K8s Service (PEM)
• [ ] AWS S3 (PEM,JWKS,SPIFFE)
• [ ] Google Cloud Storage (PEM,JWKS,SPIFFE)

[EItanya]

Hello @azdagron, can I get a little primer on bundle publisher vs notifier. I have an S3 notifier plugin I'm going to publish a PR for hopefully soon.

[amartinezfayo]

Hi @EItanya, the plan is to depreciate the Notifier plugin interface in favor of the BundlePublisher interface. Please see #2909 for more details. Unfortunately, we don't really plan to add new Notifier plugins at this time. We already have support for BundlePublisher plugins in SPIRE, and I have an aws_s3 plugin PR mostly ready to be submitted, so we should have that support soon.

[EItanya]

Oh ok, thanks so much for the context!

[ahoze-r7]

also publishing the bundle to "K8s Secret" or "AWS secret manager" can helm if you publish it to regular secret , we can use pushSecret crd of external secret in order to sync with AWS secret manager/ Vault etc...

[kfox1111]

Maybe azure blob as well