Looking for collaborators / ideas on how to leverage an NRI plugin for the purpose of managing identity artifacts in containers/pods

The idea is about using an NRI plugin to manage setup of identity artifcats for container/pods. Oriented around Spiffe/Spire, the idea is to create and mount identity artifacts/certificate during container creation time. Instead of the application in the container creating and fetching its identify artificats, this NRI identity plugin would manage setting it up for the application/workload. An alternative way is to extend Envoy to manage identities for the application. An additional idea which I don't fully understand yet is to let applications access files outside the container by mounting a root hosted file.

This is from a rough discussion I had with @mikebrow

Open Questions:

- Spiffe SVID certificates/documents are short lived. What should happen to the container / pod after the certificate expires?
- Restart or fail the pod/container.
- Pause the container.
- Do some tricks to update the mounted certificate/artifact dynamically.

Some links from our discussions:

- https://github.com/spiffe/spire-plugin-sdk
- https://medium.com/kagenti-the-agentic-platform/identity-in-agentic-platforms-enabling-secure-least-privilege-access-996527f1c983
- https://github.com/kagenti/kagenti/tree/main/kagenti/examples/identity

Slack discussion thread: https://cloud-native.slack.com/archives/CGEQHPYF4/p1760517445810219