Enable the SPIFFE socket volume and endpoint to be configured #309

mattbates · 2025-09-03T16:11:12Z

Fixes #308.

gemini-code-assist

Summary of Changes

Hello @mattbates, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the cofidectl workload status command by providing greater control over how the ephemeral debug container interacts with SPIFFE workloads. It introduces new configuration options for the SPIFFE socket, making the tool more adaptable to various deployment environments and SPIFFE configurations.

Highlights

Configurable SPIFFE Socket Options: Introduced new command-line flags ("--spiffe-socket-volume" and "--spiffe-socket-endpoint") to the cofidectl workload status command, allowing users to specify the SPIFFE socket volume name and endpoint URI.
Dynamic Debug Container Configuration: The ephemeral debug container creation logic has been updated to utilize these new SPIFFE configuration parameters, enabling dynamic mounting of the specified SPIFFE socket volume and setting the SPIFFE_ENDPOINT_SOCKET environment variable.
Debug Container Image Update: The default debug container image has been updated from v0.2.1 to v0.2.2-dev.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces the ability to configure the SPIFFE socket volume and endpoint when checking a workload's status. The implementation correctly adds new flags to the workload status command and passes these values down to where the ephemeral debug container is created. The changes are logical and well-contained. I have a couple of suggestions to improve the clarity of the new command-line options and to enhance code consistency, which should improve maintainability.

gemini-code-assist · 2025-09-03T16:12:40Z

cmd/cofidectl/cmd/workload/workload.go

 	f.StringVar(&opts.namespace, "namespace", "", "Namespace for the workload")
 	f.StringVar(&opts.trustZone, "trust-zone", "", "Trust zone for the workload")
+	f.StringVar(&opts.spiffeSocketVolume, "spiffe-socket-volume", "spiffe-workload-api", "The volume for the SPIFFE socket (UDS)")
+	f.StringVar(&opts.spiffeSocketEndpoint, "spiffe-socket-endpoint", "", "The full SPIFFE socket (UDS) endpoint URI, which should be prefixed with the /spiffe-workload-api directory.")


The help text for spiffe-socket-endpoint is a bit confusing. It mentions a "full... URI" but also that it "should be prefixed with". This can be ambiguous for users. A clearer description explaining that this is a path inside the container and giving an example would be more helpful.

Suggested change

f.StringVar(&opts.spiffeSocketEndpoint, "spiffe-socket-endpoint", "", "The full SPIFFE socket (UDS) endpoint URI, which should be prefixed with the /spiffe-workload-api directory.")

f.StringVar(&opts.spiffeSocketEndpoint, "spiffe-socket-endpoint", "", "Path to the SPIFFE Workload API socket in the debug container. The volume is mounted at /spiffe-workload-api, so the path should be under this directory (e.g. /spiffe-workload-api/agent.sock).")

gemini-code-assist · 2025-09-03T16:12:40Z

internal/pkg/workload/workload.go

 }

-func GetStatus(ctx context.Context, statusCh chan<- *provisionpb.Status, dataCh chan string, client *kubeutil.Client, podName string, namespace string) {
+func GetStatus(ctx context.Context, statusCh chan<- *provisionpb.Status, dataCh chan string, client *kubeutil.Client, podName, namespace, spiffeSocketEndpoint, spiffeSocketVolumeMount string) {


The parameter for the SPIFFE socket volume name is inconsistent across function calls (spiffeSocketVolume, spiffeSocketVolumeMount, spiffeSocketVolumeName). For better readability and maintainability, it's best to use a single, consistent name. spiffeSocketVolumeName, as used in createDebugContainer, is descriptive and would be a good choice to standardize on.

I suggest refactoring to use spiffeSocketVolumeName in:

StatusOpts struct in cmd/cofidectl/cmd/workload/workload.go

getWorkloadStatus function in cmd/cofidectl/cmd/workload/workload.go

This GetStatus function signature and its usage of the parameter.

Suggested change

func GetStatus(ctx context.Context, statusCh chan<- *provisionpb.Status, dataCh chan string, client *kubeutil.Client, podName, namespace, spiffeSocketEndpoint, spiffeSocketVolumeMount string) {

func GetStatus(ctx context.Context, statusCh chan<- *provisionpb.Status, dataCh chan string, client *kubeutil.Client, podName, namespace, spiffeSocketEndpoint, spiffeSocketVolumeName string) {

jsnctl · 2025-09-04T07:13:50Z

internal/pkg/workload/workload.go


 const debugContainerNamePrefix = "cofidectl-debug"
-const debugContainerImage = "ghcr.io/cofide/cofidectl-debug-container:v0.2.1"
+const debugContainerImage = "ghcr.io/cofide/cofidectl-debug-container:v0.2.2-dev"


This looks to be causing failures in the CI

markgoddard · 2025-09-15T10:24:26Z

internal/pkg/workload/workload.go


+	if spiffeSocketEndpoint != "" {
+		debugContainer.Env = append(debugContainer.Env, v1.EnvVar{
+			Name:  "SPIFFE_ENDPOINT_SOCKET",


To check: does this work with the existing image? go-spiffe should support this natively.

mattbates added 6 commits September 3, 2025 15:04

add option to specify volume mount for the Workload API socket

afc8169

add config option for the SPIFFE socket path

8e4147f

switch order of vars

fc76d24

use endpoint instead of path to be more precise

fb6564f

fix typo

9fdb7a6

fix typo

ec8968f

gemini-code-assist bot reviewed Sep 3, 2025

View reviewed changes

mattbates added this to the 2025-07-now milestone Sep 3, 2025

mattbates self-assigned this Sep 3, 2025

gemini-code-assist bot reviewed Sep 3, 2025

View reviewed changes

jsnctl reviewed Sep 4, 2025

View reviewed changes

markgoddard reviewed Sep 15, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Enable the SPIFFE socket volume and endpoint to be configured #309

Enable the SPIFFE socket volume and endpoint to be configured #309

Uh oh!

mattbates commented Sep 3, 2025 •

edited

Loading

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Sep 3, 2025

Uh oh!

gemini-code-assist bot Sep 3, 2025

Uh oh!

jsnctl Sep 4, 2025

Uh oh!

markgoddard Sep 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	f.StringVar(&opts.spiffeSocketEndpoint, "spiffe-socket-endpoint", "", "The full SPIFFE socket (UDS) endpoint URI, which should be prefixed with the /spiffe-workload-api directory.")
	f.StringVar(&opts.spiffeSocketEndpoint, "spiffe-socket-endpoint", "", "Path to the SPIFFE Workload API socket in the debug container. The volume is mounted at /spiffe-workload-api, so the path should be under this directory (e.g. /spiffe-workload-api/agent.sock).")

	func GetStatus(ctx context.Context, statusCh chan<- provisionpb.Status, dataCh chan string, client kubeutil.Client, podName, namespace, spiffeSocketEndpoint, spiffeSocketVolumeMount string) {
	func GetStatus(ctx context.Context, statusCh chan<- provisionpb.Status, dataCh chan string, client kubeutil.Client, podName, namespace, spiffeSocketEndpoint, spiffeSocketVolumeName string) {

Enable the SPIFFE socket volume and endpoint to be configured #309

Are you sure you want to change the base?

Enable the SPIFFE socket volume and endpoint to be configured #309

Uh oh!

Conversation

mattbates commented Sep 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Sep 3, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Sep 3, 2025

Choose a reason for hiding this comment

Uh oh!

jsnctl Sep 4, 2025

Choose a reason for hiding this comment

Uh oh!

markgoddard Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

mattbates commented Sep 3, 2025 •

edited

Loading