spiffe-step-ssh server

[kfox1111]

Add a feature to enable trading a spire based cert for a signed ssh host cert automatically.

This enables hosts to start from scratch at bringup, attest with spire, and then get a signed ssh certificate users can trust came from the ssh ca.

Server components involved:

• spire-server (deployed with spire chart)
• step-ca server (deployed with spire-step-ssh)
  • step - step certificate authority instance
  • spiffe-step-ssh-fetchca - lets you fetch the ca.pem for step using spiffe's certs for trust.
  • spiffe-step-sssh-config - generates and maintains the config file for step. Injects the spiffe ca into the config.

Host components involved:

• spire-agent
• spiffe-helper
• step (step ca client)
• sshd

User components:

• ssh (client)
• configure known_hosts with step-ca ssh signature.

[edwbuck]

Please update this commit to the baseline, so we can better determine if it is nearly ready for 0.22.0.

[edwbuck]

A small description of the architectural elements that are going to be impacted is needed. This request comes from having some SSH clients that are not managed within the HELM items being supported, which impacts the overall security of the solution. I think the feature could be very beneficial, but the original problem being solved (other than containerized process access) needs a description, as well as all the impacted components (within HELM and outside of HELM).