feat(gateway): broker stable sandbox SPIFFE provider tokens

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

.agents/skills/helm-dev-environment/SKILL.md

@@ -96,6 +96,14 @@ OPENSHELL_E2E_KUBE_IMAGE_PULL_SECRET=e2e-regcred \
   mise run e2e:kubernetes:shared-supervisor
 ```
 
+`mise run e2e:kubernetes:shared-supervisor-spiffe` installs pinned SPIRE charts
+(`ci/values-spire-delegation-stack.yaml`, removed again on exit) and the
+`openshell.gateway.experimental_spiffe_delegation` overlay
+(`ci/values-supervisor-spiffe.yaml`), then registers sandbox
+identities with `ClusterStaticEntry` resources. `mise run test:spire-delegation`
+checks delegated issuance and identity selection against a local SPIRE server
+and agent without a cluster; the Kubernetes test covers the gateway broker.
+
 ### 2. Deploy OpenShell
 
 **Iterative dev** (rebuilds on file changes, recommended during active development):

Cargo.lock

@@ -80,6 +80,14 @@ impl TestOpenShell {
 
 #[tonic::async_trait]
 impl OpenShell for TestOpenShell {
+    async fn get_sandbox_provider_access_token(
+        &self,
+        _request: tonic::Request<openshell_core::proto::GetSandboxProviderAccessTokenRequest>,
+    ) -> Result<Response<openshell_core::proto::GetSandboxProviderAccessTokenResponse>, Status>
+    {
+        Err(Status::unimplemented("not used by this test server"))
+    }
+
     async fn peer_notify_config_update(
         &self,
         _request: tonic::Request<openshell_core::proto::PeerNotifyConfigUpdateRequest>,

crates/openshell-cli/tests/ensure_providers_integration.rs

@@ -32,6 +32,14 @@ struct TestOpenShell;
 
 #[tonic::async_trait]
 impl OpenShell for TestOpenShell {
+    async fn get_sandbox_provider_access_token(
+        &self,
+        _request: tonic::Request<openshell_core::proto::GetSandboxProviderAccessTokenRequest>,
+    ) -> Result<Response<openshell_core::proto::GetSandboxProviderAccessTokenResponse>, Status>
+    {
+        Err(Status::unimplemented("not used by this test server"))
+    }
+
     async fn peer_notify_config_update(
         &self,
         _request: tonic::Request<openshell_core::proto::PeerNotifyConfigUpdateRequest>,

crates/openshell-cli/tests/mtls_integration.rs

@@ -235,6 +235,14 @@ impl TestOpenShell {
 
 #[tonic::async_trait]
 impl OpenShell for TestOpenShell {
+    async fn get_sandbox_provider_access_token(
+        &self,
+        _request: tonic::Request<openshell_core::proto::GetSandboxProviderAccessTokenRequest>,
+    ) -> Result<Response<openshell_core::proto::GetSandboxProviderAccessTokenResponse>, Status>
+    {
+        Err(Status::unimplemented("not used by this test server"))
+    }
+
     async fn peer_notify_config_update(
         &self,
         _request: tonic::Request<openshell_core::proto::PeerNotifyConfigUpdateRequest>,

crates/openshell-cli/tests/provider_commands_integration.rs

@@ -101,6 +101,14 @@ struct TestOpenShell {
 
 #[tonic::async_trait]
 impl OpenShell for TestOpenShell {
+    async fn get_sandbox_provider_access_token(
+        &self,
+        _request: tonic::Request<openshell_core::proto::GetSandboxProviderAccessTokenRequest>,
+    ) -> Result<Response<openshell_core::proto::GetSandboxProviderAccessTokenResponse>, Status>
+    {
+        Err(Status::unimplemented("not used by this test server"))
+    }
+
     async fn peer_notify_config_update(
         &self,
         _request: tonic::Request<openshell_core::proto::PeerNotifyConfigUpdateRequest>,

crates/openshell-cli/tests/sandbox_create_lifecycle_integration.rs

@@ -163,6 +163,13 @@ macro_rules! mock_gateway {
     ) => {
         #[tonic::async_trait]
         impl OpenShell for MockGateway {
+    async fn get_sandbox_provider_access_token(
+        &self,
+        _request: Request<proto::GetSandboxProviderAccessTokenRequest>,
+    ) -> Result<Response<proto::GetSandboxProviderAccessTokenResponse>, Status> {
+        Err(Status::unimplemented("not used by this test server"))
+    }
+
             $(async fn $method(&self, _: Request<$request>) -> Result<Response<$response>, Status> {
                 Err(Status::unimplemented("unused test RPC"))
             })*

crates/openshell-cli/tests/sandbox_exec_streaming_integration.rs

@@ -47,6 +47,14 @@ struct TestOpenShell {
 
 #[tonic::async_trait]
 impl OpenShell for TestOpenShell {
+    async fn get_sandbox_provider_access_token(
+        &self,
+        _request: tonic::Request<openshell_core::proto::GetSandboxProviderAccessTokenRequest>,
+    ) -> Result<Response<openshell_core::proto::GetSandboxProviderAccessTokenResponse>, Status>
+    {
+        Err(Status::unimplemented("not used by this test server"))
+    }
+
     async fn peer_notify_config_update(
         &self,
         _request: tonic::Request<openshell_core::proto::PeerNotifyConfigUpdateRequest>,

crates/openshell-cli/tests/sandbox_name_fallback_integration.rs

@@ -205,6 +205,39 @@ pub fn normalize_compute_driver_name(value: &str) -> Result<String, String> {
     Ok(value.to_ascii_lowercase())
 }
 
+/// Experimental gateway-owned SPIRE delegation for sandbox provider grants.
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ExperimentalSpiffeDelegationConfig {
+    pub admin_socket_path: String,
+    pub spiffe_id_prefix: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub admin_socket_group: Option<u32>,
+}
+
+impl ExperimentalSpiffeDelegationConfig {
+    /// Reject ambiguous host paths and identities before opening the SPIRE socket.
+    pub fn validate(&self, gateway_id: &str) -> Result<(), String> {
+        let path = std::path::Path::new(&self.admin_socket_path);
+        if !path.is_absolute()
+            || path
+                .parent()
+                .is_none_or(|parent| parent == std::path::Path::new("/"))
+            || self
+                .admin_socket_path
+                .split('/')
+                .skip(1)
+                .any(|part| part.is_empty() || part == "." || part == "..")
+            || self.admin_socket_group == Some(0)
+        {
+            return Err("experimental_spiffe_delegation requires a canonical absolute admin socket path in a dedicated directory and a non-root socket group".into());
+        }
+        crate::spiffe::SandboxSpiffeIdPrefix::parse(&self.spiffe_id_prefix)?
+            .sandbox_spiffe_id(gateway_id, "sandbox")?;
+        Ok(())
+    }
+}
+
 /// Server configuration.
 ///
 /// Built programmatically in [`crate::Config::new`] and the gateway CLI from
@@ -269,6 +302,8 @@ pub struct Config {
     /// JWTs as `Principal::Sandbox`. Required for the per-sandbox identity
     /// flow (issue #1354).
     pub gateway_jwt: Option<GatewayJwtConfig>,
+    /// Gateway-only access to SPIRE; shared supervisors receive access tokens.
+    pub experimental_spiffe_delegation: Option<ExperimentalSpiffeDelegationConfig>,
 
     /// Database URL for persistence.
     pub database_url: String,
@@ -940,6 +975,7 @@ impl Config {
             provider_profile_sources: vec![GatewayProviderProfileSourceConfig::User],
             mtls_auth: MtlsAuthConfig::default(),
             gateway_jwt: None,
+            experimental_spiffe_delegation: None,
             database_url: String::new(),
             database_max_connections: None,
             database_lock_max_connections: None,

crates/openshell-core/src/config.rs

@@ -1578,6 +1578,46 @@ pub async fn exchange_provider_subject_token(
     ))
 }
 
+/// Obtain only the final access token; the gateway selects and verifies the
+/// sandbox identity and resolves all grant parameters from its configuration.
+#[tracing::instrument(name = "supervisor.gateway.get_provider_access_token", skip_all)]
+pub async fn get_sandbox_provider_access_token(
+    gateway: &GatewayEndpoint,
+    credential_key: &str,
+    request_id: Option<&str>,
+) -> std::result::Result<ProviderSubjectTokenExchangeResult, TokenGrantFailure> {
+    let endpoint = token_grant_gateway_endpoint(gateway.url())?;
+    let mut client = connect(&gateway.with_url(endpoint.as_str()))
+        .await
+        .map_err(|_| gateway_grant_failure(TokenGrantFailureKind::Unavailable))?;
+    let mut request = tonic::Request::new(crate::proto::GetSandboxProviderAccessTokenRequest {
+        credential_key: credential_key.to_string(),
+    });
+    if let Some(value) = request_id.and_then(|value| value.parse().ok()) {
+        request.metadata_mut().insert("x-request-id", value);
+    }
+    let response = tokio::time::timeout(
+        Duration::from_mins(1),
+        client.get_sandbox_provider_access_token(request),
+    )
+    .await
+    .map_err(|_| gateway_grant_failure(TokenGrantFailureKind::Timeout))?
+    .map_err(|status| provider_subject_token_exchange_status(&status, &endpoint))?
+    .into_inner();
+    // connect() and the response boundary both reject locally revoked sandbox
+    // instance credentials.
+    if gateway.credentials().is_revoked() {
+        return Err(gateway_grant_failure(
+            TokenGrantFailureKind::WorkloadIdentityRejected,
+        ));
+    }
+    provider_subject_token_exchange_result(crate::proto::ExchangeProviderSubjectTokenResponse {
+        access_token: response.access_token,
+        expires_after: response.expires_after,
+        token_type: response.token_type,
+    })
+}
+
 /// Attach the exchange's request ID as `x-request-id` gRPC metadata.
 ///
 /// A value that is not valid metadata is omitted, never rewritten.