Resolve "ultimate owner" of pod

Background

The default SVID template is

spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}

where the assumption is that the service account name is descriptive of what deployment this is.

Problems

The above have the following problems

1. By default pods are assigned the default service account for that namespace
2. Service accounts are namespaced resources. So deployment foo can highjack the service account for bar.

The above can be mitigated by a policy framework like OPA gatekeeper or kyverno.

Proposal

Add "UltimateOwner" to the SVID template.
It is then the responsibility the controller manager to walk the owner reference to resolve the ultimate owner.
As this is costly, then it should only be done when necessary.
With ultimate owner it means

• Pod -> ReplicaSet -> Deployment
• Pod -> ReplicaSet -> Argo Rollout
• Pod -> StatefulSet
• Pod -> DaemonSet

It is important how the owner walk is terminated.
Here is two options

1. Walk the chain until it encounters a controller managed resource
2. Walk the chain until we encounter an owner that is (Deployment, Rollout, StatefulSet, DaemonSet)

The downside of $1 is that resources deployed as CRD eg. ElasticCluster might have multiple Deployments.
Then all of these are granted the same SVID.

The downside of $2 is that an explicit heuristic should be written in the controller.
Alternatively, a list of resources that terminates the walk.

Runtime considerations

This will require a dynamic lookup of the ultimate owner.

§1 will add informer caches on all resources in the chain.

§2 will add informer caches on ReplicaSet.
On a large cluster this will require significant memory.

RBAC

§1 will need list, get, watch on the above:

• ReplicaSet
• Deployment
• Rollout
• StatefulSet
• DaemonSet

§2 will need it on ReplicaSet.

Draft

https://github.com/spiffe/spire-controller-manager/compare/main...Munken:spire-controller-manager:main?expand=1

Start with the proposal and the linked draft comparison to understand the intended UltimateOwner changes. Work through the two owner-walk termination options, including informer-cache and RBAC implications. Done means the project has an agreed design for resolving ultimate owners and incorporating that result into the SVID template.