Overview

Now we have registration.json file with spiffe entries that should be registered. Essentially this is simple mapping of ServiceAccount to SpiffeID. That's not really convenient way to manage spiffe entries.

Spire provides k8s-workload-registrar that register itself like admission-webhook and automatically register entries based on service accounts, labels or annotations.

Blocked by BoundServiceAccountTokenVolume feature of Kubernetes, which is still in alpha:
https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/