1
apiVersion: v1
2
kind: ConfigMap
3
metadata:
4
  name: spire-server-edge-config
5
  namespace: spire-system
6
data:
7
  server.conf: |
8
    server {
9
      bind_address = "0.0.0.0"
10
      bind_port = "8081"
11
      socket_path = "/tmp/spire-server/private/api.sock"
12
      trust_domain = "edge.company.com"
13
      data_dir = "/run/spire/data"
14
      log_level = "INFO"
15

16
      # Edge-specific configuration
17
      experimental {
18
        # Enable offline operation
19
        cache_enabled = true
20
        cache_size = 1000
21
        cache_ttl = "24h"
22

23
        # Bundle caching for offline periods
24
        bundle_cache_enabled = true
25
        bundle_cache_size = 100
26

27
        # Reduced memory footprint
28
        memory_limit = "256MB"
29

30
        # Batch operations for efficiency
31
        batch_size = 50
32
        batch_timeout = "5s"
33
      }
34

35
      # Default SVID TTL optimized for edge
36
      default_svid_ttl = "4h"
37
      default_jwt_svid_ttl = "15m"
38

39
      # CA configuration for edge
40
      ca_subject = {
41
        country = ["US"],
42
        organization = ["Company Corp"],
43
        organizational_unit = ["Edge Computing"],
44
        common_name = "SPIRE Edge CA",
45
      }
46

47
      # JWT issuer for edge devices
48
      jwt_issuer = "https://edge-oidc.company.com"
49

50
      # Federation with cloud and other edge sites
51
      federation {
52
        bundle_endpoint {
53
          address = "0.0.0.0"
54
          port = 8443
55

56
          # Lightweight TLS for edge
57
          tls {
58
            cert_chain_path = "/etc/ssl/spire/edge-bundle.crt"
59
            private_key_path = "/etc/ssl/spire/edge-bundle.key"
60
          }
61
        }
62

63
        federates_with {
64
          # Federation with cloud
65
          "cloud.company.com" {
66
            bundle_endpoint_url = "https://spire-bundle.cloud.company.com:8443"
67
            bundle_endpoint_profile {
68
              type = "https_spiffe"
69
              endpoint_spiffe_id = "spiffe://cloud.company.com/spire/server"
70
            }
71
            refresh_hint = "1h"
72
          }
73

74
          # Federation with other edge sites
75
          "edge-west.company.com" {
76
            bundle_endpoint_url = "https://spire-bundle.edge-west.company.com:8443"
77
            bundle_endpoint_profile {
78
              type = "https_spiffe"
79
              endpoint_spiffe_id = "spiffe://edge-west.company.com/spire/server"
80
            }
81
            refresh_hint = "4h"
82
          }
83
        }
84
      }
85
    }
86

87
    plugins {
88
      # Join token node attestor for edge devices
89
      NodeAttestor "join_token" {
90
        plugin_data {
91
          # Extended TTL for edge device provisioning
92
          ttl = "168h"  # 1 week
93

94
          # Allow token reuse for device replacement
95
          allow_token_reuse = true
96

97
          # Store tokens in persistent storage
98
          token_dir = "/run/spire/data/tokens"
99
        }
100
      }
101

102
      # TPM node attestor for secure edge devices
103
      NodeAttestor "tpm" {
104
        plugin_data {
105
          tpm_path = "/dev/tpmrm0"
106
          hash_algorithm = "sha256"
107
          pcr_selections {
108
            hash_alg = "sha256"
109
            pcr_ids = [0, 1, 2, 7]
110
          }
111

112
          # Edge-specific TPM configuration
113
          cache_attestation = true
114
          cache_ttl = "24h"
115

116
          # Allow some PCR variance for edge environments
117
          pcr_tolerance = "medium"
118
        }
119
      }
120

121
      # X.509 certificate attestor for pre-provisioned devices
122
      NodeAttestor "x509pop" {
123
        plugin_data {
124
          ca_bundle_path = "/etc/ssl/spire/edge-device-ca.pem"
125

126
          # Subject verification for edge devices
127
          subject_filter {
128
            common_name = {
129
              # Match device serial numbers
130
              pattern = "device-[0-9a-f]{12}"
131
              required = true
132
            }
133

134
            organization = ["Company Corp"]
135
            organizational_unit = ["Edge Devices"]
136
          }
137

138
          # Additional validation for edge
139
          verify_dns_names = false
140
          verify_email_addresses = false
141
        }
142
      }
143

144
      # Kubernetes workload attestor (for edge K8s)
145
      WorkloadAttestor "k8s" {
146
        plugin_data {
147
          skip_kubelet_verification = true  # Edge K8s may have different configs
148
          kubelet_secure_port = 10250
149

150
          # Edge-specific configuration
151
          node_name_env = "MY_NODE_NAME"
152
          cluster_name = "edge-cluster"
153

154
          # Reduced API calls for low bandwidth
155
          use_cached_node_selector = true
156
          cache_node_selectors_ttl = "1h"
157
        }
158
      }
159

160
      # Unix workload attestor for non-containerized edge workloads
161
      WorkloadAttestor "unix" {
162
        plugin_data {
163
          discover_workload_path = true
164

165
          # Edge-specific path patterns
166
          workload_size_limit = 1048576  # 1MB limit for edge
167

168
          # Process detection for edge workloads
169
          process_cmdline_patterns = [
170
            "/opt/edge-app/.*",
171
            "/usr/local/iot/.*",
172
            "/home/iot/.*"
173
          ]
174
        }
175
      }
176

177
      # Docker workload attestor for containerized edge apps
178
      WorkloadAttestor "docker" {
179
        plugin_data {
180
          docker_socket_path = "unix:///var/run/docker.sock"
181

182
          # Edge container detection
183
          container_id_cgroup_matchers = [
184
            "/docker/([^/]+)",
185
            "/system.slice/docker-([^.]+).scope"
186
          ]
187

188
          # Reduced Docker API calls
189
          use_new_container_locator = true
190
          container_discovery_interval = "30s"
191
        }
192
      }
193

194
      # SQLite data store for edge (lightweight)
195
      DataStore "sql" {
196
        plugin_data {
197
          database_type = "sqlite3"
198
          connection_string = "/run/spire/data/datastore.sqlite3"
199

200
          # Edge optimizations
201
          max_open_connections = 5
202
          max_idle_connections = 2
203
          connection_max_lifetime = "1h"
204

205
          # SQLite-specific optimizations
206
          sqlite_pragmas = [
207
            "journal_mode=WAL",
208
            "synchronous=NORMAL",
209
            "cache_size=2000",
210
            "temp_store=memory"
211
          ]
212
        }
213
      }
214

215
      # Disk key manager (simple for edge)
216
      KeyManager "disk" {
217
        plugin_data {
218
          keys_path = "/run/spire/data/keys.json"
219

220
          # Key rotation for edge
221
          key_rotation_interval = "72h"
222
          key_backup_enabled = true
223
          key_backup_path = "/run/spire/backup/keys"
224
        }
225
      }
226

227
      # Disk upstream authority or cloud federation
228
      UpstreamAuthority "disk" {
229
        plugin_data {
230
          cert_file_path = "/run/spire/ca/ca.crt"
231
          key_file_path = "/run/spire/ca/ca.key"
232

233
          # Auto-renewal for edge
234
          cert_renewal_threshold = "168h"  # 1 week
235
        }
236
      }
237

238
      # Optional: Cloud upstream authority for managed edge
239
      # UpstreamAuthority "aws_pca" {
240
      #   plugin_data {
241
      #     certificate_authority_arn = "arn:aws:acm-pca:region:account:certificate-authority/ca-id"
242
      #     region = "us-east-1"
243
      #     validity_period_hours = 168  # 1 week for edge
244
      #   }
245
      # }
246
    }
247

248
    health_checks {
249
      listener_enabled = true
250
      bind_address = "0.0.0.0"
251
      bind_port = "8080"
252
      live_path = "/live"
253
      ready_path = "/ready"
254
    }
255

256
    telemetry {
257
      Prometheus {
258
        bind_address = "0.0.0.0"
259
        bind_port = "9988"
260
      }
261

262
      # Lightweight logging for edge
263
      file_sink {
264
        log_file_path = "/var/log/spire/server.log"
265
        log_format = "json"
266
        log_level = "INFO"
267
        max_file_size = "10MB"
268
        max_files = 3
269
      }
270
    }

1
apiVersion: v1
2
kind: ConfigMap
3
metadata:
4
  name: spire-agent-iot-config
5
  namespace: spire-system
6
data:
7
  agent.conf: |
8
    agent {
9
      data_dir = "/var/lib/spire/data"
10
      log_level = "WARN"  # Reduced logging for performance
11
      server_address = "edge-spire-server.local"
12
      server_port = "8081"
13
      socket_path = "/var/run/spire/sockets/agent.sock"
14
      trust_bundle_path = "/var/lib/spire/bundle/bundle.crt"
15
      trust_domain = "edge.company.com"
16

17
      # IoT-specific configuration
18
      experimental {
19
        # Reduced memory footprint
20
        memory_limit = "64MB"
21

22
        # Batch operations for efficiency
23
        batch_size = 10
24
        batch_timeout = "30s"
25

26
        # Sync interval optimization for IoT
27
        sync_interval = "60s"
28

29
        # Cache SVIDs for offline operation
30
        svid_cache_enabled = true
31
        svid_cache_size = 50
32
        svid_cache_ttl = "6h"
33

34
        # Workload API optimization
35
        workload_api_named_pipe_name = "spire-agent"
36
        workload_api_connection_timeout = "30s"
37
      }
38

39
      # Join token for initial attestation
40
      join_token = "${SPIRE_JOIN_TOKEN}"
41

42
      # Insecure bootstrap allowed for initial IoT setup
43
      insecure_bootstrap = false
44
    }
45

46
    plugins {
47
      # TPM node attestor for secure IoT devices
48
      NodeAttestor "tpm" {
49
        plugin_data {
50
          tpm_path = "/dev/tpmrm0"
51
          hash_algorithm = "sha256"
52

53
          # IoT-optimized TPM settings
54
          cache_quotes = true
55
          quote_cache_ttl = "12h"
56

57
          # Reduced PCR checking for IoT
58
          pcr_selections {
59
            hash_alg = "sha256"
60
            pcr_ids = [0, 7]  # Minimal PCRs for IoT
61
          }
62

63
          # IoT device identification
64
          device_id_from_tpm = true
65
          include_ek_cert = true
66
        }
67
      }
68

69
      # X.509 certificate attestor for pre-provisioned IoT
70
      NodeAttestor "x509pop" {
71
        plugin_data {
72
          ca_bundle_path = "/etc/ssl/spire/iot-device-ca.pem"
73

74
          # Certificate validation
75
          subject_filter {
76
            common_name = {
77
              pattern = "iot-device-[0-9a-f]{16}"
78
              required = true
79
            }
80
          }
81
        }
82
      }
83

84
      # Join token attestor for simple IoT deployment
85
      NodeAttestor "join_token" {
86
        plugin_data {
87
          # Token provided via environment or config
88
          token_dir = "/var/lib/spire/tokens"
89
        }
90
      }
91

92
      # Unix workload attestor for IoT processes
93
      WorkloadAttestor "unix" {
94
        plugin_data {
95
          discover_workload_path = true
96

97
          # IoT-specific process patterns
98
          process_cmdline_patterns = [
99
            "/opt/iot-app/.*",
100
            "/usr/local/sensor/.*",
101
            "/home/pi/.*"
102
          ]
103

104
          # Reduced file system scanning
105
          workload_size_limit = 524288  # 512KB limit
106
          scan_interval = "5m"
107
        }
108
      }
109

110
      # Systemd workload attestor for IoT services
111
      WorkloadAttestor "systemd" {
112
        plugin_data {
113
          # IoT service patterns
114
          service_name_patterns = [
115
            "iot-sensor.service",
116
            "device-controller.service",
117
            "edge-gateway.service"
118
          ]
119

120
          # Systemd socket integration
121
          use_systemd_socket = true
122
        }
123
      }
124

125
      # Memory key manager for IoT (no persistent storage)
126
      KeyManager "memory" {
127
        plugin_data = {}
128
      }
129

130
      # Optional: Disk key manager for IoT with storage
131
      # KeyManager "disk" {
132
      #   plugin_data {
133
      #     keys_path = "/var/lib/spire/keys.json"
134
      #   }
135
      # }
136
    }
137

138
    health_checks {
139
      listener_enabled = true
140
      bind_address = "127.0.0.1"
141
      bind_port = "8080"
142
      live_path = "/live"
143
      ready_path = "/ready"
144
    }
145

146
    telemetry {
147
      # Minimal telemetry for IoT
148
      file_sink {
149
        log_file_path = "/var/log/spire/agent.log"
150
        log_format = "text"
151
        log_level = "WARN"
152
        max_file_size = "5MB"
153
        max_files = 2
154
      }
155
    }

1
apiVersion: spire.spiffe.io/v1alpha1
2
kind: ClusterSPIFFEID
3
metadata:
4
  name: iot-sensors
5
  labels:
6
    device-type: sensor
7
    environment: edge
8
spec:
9
  # IoT sensor identity pattern
10
  spiffeIDTemplate: |
11
    {{- $deviceId := required "device-id label required" .PodMeta.Labels.device-id -}}
12
    {{- $sensorType := .PodMeta.Labels.sensor-type | default "generic" -}}
13
    {{- $location := .PodMeta.Labels.location | default "unknown" -}}
14
    spiffe://{{ .TrustDomain }}/iot/sensor/{{ $deviceId }}/{{ $sensorType }}/{{ $location }}
15

16
  # Select IoT sensor pods
17
  podSelector:
18
    matchLabels:
19
      device-type: sensor
20
      iot-managed: "true"
21
    matchExpressions:
22
      - key: device-id
23
        operator: Exists
24
      - key: security-level
25
        operator: In
26
        values: ["standard", "high"]
27

28
  namespaceSelector:
29
    matchLabels:
30
      edge-zone: "true"
31

32
  # IoT-specific workload selectors
33
  workloadSelectorTemplates:
34
    - "k8s:ns:{{ .PodMeta.Namespace }}"
35
    - "k8s:device-id:{{ .PodMeta.Labels.device-id }}"
36
    - "k8s:sensor-type:{{ .PodMeta.Labels.sensor-type }}"
37
    - "k8s:location:{{ .PodMeta.Labels.location }}"
38
    - "k8s:pod-name:{{ .PodMeta.Name }}"
39

40
  # No DNS names for sensors (internal communication only)
41
  dnsNameTemplates: []
42

43
  # Shorter TTL for IoT devices
44
  ttl: 7200 # 2 hours
45
  jwtSvidTTL: 300 # 5 minutes
46

47
  # No federation for basic sensors
48
  federatesWith: []
49
---
50
# Industrial control systems
51
apiVersion: spire.spiffe.io/v1alpha1
52
kind: ClusterSPIFFEID
53
metadata:
54
  name: industrial-controllers
55
  labels:
56
    device-type: controller
57
    security-level: high
58
spec:
59
  spiffeIDTemplate: |
60
    {{- $controllerId := required "controller-id required" .PodMeta.Labels.controller-id -}}
61
    {{- $system := required "system required" .PodMeta.Labels.system -}}
62
    {{- $zone := .PodMeta.Labels.zone | default "production" -}}
63
    spiffe://{{ .TrustDomain }}/industrial/{{ $system }}/controller/{{ $controllerId }}/{{ $zone }}
64

65
  podSelector:
66
    matchLabels:
67
      device-type: controller
68
      security-level: high
69
    matchExpressions:
70
      - key: controller-id
71
        operator: Exists
72
      - key: system
73
        operator: Exists
74

75
  namespaceSelector:
76
    matchLabels:
77
      industrial: "true"
78

79
  workloadSelectorTemplates:
80
    - "k8s:ns:{{ .PodMeta.Namespace }}"
81
    - "k8s:controller-id:{{ .PodMeta.Labels.controller-id }}"
82
    - "k8s:system:{{ .PodMeta.Labels.system }}"
83
    - "k8s:zone:{{ .PodMeta.Labels.zone }}"
84
    - "k8s:safety-level:{{ .PodMeta.Labels.safety-level }}"
85

86
  # Industrial system DNS
87
  dnsNameTemplates:
88
    - "{{ .PodMeta.Labels.controller-id }}.{{ .PodMeta.Labels.system }}.industrial.local"
89

90
  # Longer TTL for stable industrial systems
91
  ttl: 14400 # 4 hours
92

93
  # Limited federation for industrial systems
94
  federatesWith:
95
    - "cloud.company.com" # Report to cloud
96
---
97
# Edge gateways
98
apiVersion: spire.spiffe.io/v1alpha1
99
kind: ClusterSPIFFEID
100
metadata:
101
  name: edge-gateways
102
  labels:
103
    device-type: gateway
104
    security-level: high
105
spec:
106
  spiffeIDTemplate: |
107
    {{- $gatewayId := required "gateway-id required" .PodMeta.Labels.gateway-id -}}
108
    {{- $region := .PodMeta.Labels.region | default "unknown" -}}
109
    {{- $facility := .PodMeta.Labels.facility | default "generic" -}}
110
    spiffe://{{ .TrustDomain }}/edge/gateway/{{ $gatewayId }}/{{ $region }}/{{ $facility }}
111

112
  podSelector:
113
    matchLabels:
114
      device-type: gateway
115
    matchExpressions:
116
      - key: gateway-id
117
        operator: Exists
118

119
  workloadSelectorTemplates:
120
    - "k8s:ns:{{ .PodMeta.Namespace }}"
121
    - "k8s:gateway-id:{{ .PodMeta.Labels.gateway-id }}"
122
    - "k8s:region:{{ .PodMeta.Labels.region }}"
123
    - "k8s:facility:{{ .PodMeta.Labels.facility }}"
124
    - "k8s:gateway-type:{{ .PodMeta.Labels.gateway-type }}"
125

126
  # Gateway DNS for external communication
127
  dnsNameTemplates:
128
    - "{{ .PodMeta.Labels.gateway-id }}.edge.company.com"
129
    - "gateway.{{ .PodMeta.Labels.facility }}.company.com"
130

131
  # Standard TTL for gateways
132
  ttl: 3600
133

134
  # Admin privileges for gateways
135
  admin: true
136

137
  # Full federation for gateways
138
  federatesWith:
139
    - "cloud.company.com"
140
    - "edge-west.company.com"
141
    - "edge-east.company.com"
142
---
143
# Smart building devices
144
apiVersion: spire.spiffe.io/v1alpha1
145
kind: ClusterSPIFFEID
146
metadata:
147
  name: smart-building-devices
148
  labels:
149
    device-type: building-automation
150
    environment: commercial
151
spec:
152
  spiffeIDTemplate: |
153
    {{- $building := required "building required" .PodMeta.Labels.building -}}
154
    {{- $floor := .PodMeta.Labels.floor | default "0" -}}
155
    {{- $room := .PodMeta.Labels.room | default "common" -}}
156
    {{- $deviceType := .PodMeta.Labels.device-type | default "generic" -}}
157
    spiffe://{{ .TrustDomain }}/building/{{ $building }}/floor-{{ $floor }}/room-{{ $room }}/{{ $deviceType }}
158

159
  podSelector:
160
    matchLabels:
161
      category: building-automation
162
    matchExpressions:
163
      - key: building
164
        operator: Exists
165

166
  workloadSelectorTemplates:
167
    - "k8s:ns:{{ .PodMeta.Namespace }}"
168
    - "k8s:building:{{ .PodMeta.Labels.building }}"
169
    - "k8s:floor:{{ .PodMeta.Labels.floor }}"
170
    - "k8s:room:{{ .PodMeta.Labels.room }}"
171
    - "k8s:device-type:{{ .PodMeta.Labels.device-type }}"
172

173
  # Building automation TTL
174
  ttl: 10800 # 3 hours
175

176
  # No federation for building devices
177
  federatesWith: []

1
package main
2

3
import (
4
    "context"
5
    "crypto/tls"
6
    "encoding/json"
7
    "fmt"
8
    "log"
9
    "math/rand"
10
    "net/http"
11
    "os"
12
    "time"
13

14
    "github.com/spiffe/go-spiffe/v2/spiffeid"
15
    "github.com/spiffe/go-spiffe/v2/spiffetls/tlsconfig"
16
    "github.com/spiffe/go-spiffe/v2/workloadapi"
17
)
18

19
type SensorReading struct {
20
    DeviceID    string    `json:"device_id"`
21
    SensorType  string    `json:"sensor_type"`
22
    Value       float64   `json:"value"`
23
    Unit        string    `json:"unit"`
24
    Timestamp   time.Time `json:"timestamp"`
25
    Location    string    `json:"location"`
26
    Status      string    `json:"status"`
27
}
28

29
type IoTSensor struct {
30
    client     *workloadapi.Client
31
    deviceID   string
32
    sensorType string
33
    location   string
34
    gatewayURL string
35
}
36

37
func main() {
38
    ctx := context.Background()
39

40
    // Get configuration from environment
41
    deviceID := getEnv("DEVICE_ID", "sensor-001")
42
    sensorType := getEnv("SENSOR_TYPE", "temperature")
43
    location := getEnv("LOCATION", "warehouse-a")
44
    gatewayURL := getEnv("GATEWAY_URL", "https://edge-gateway.local:8443")
45

46
    // Create SPIFFE Workload API client with retries for edge connectivity
47
    client, err := createWorkloadAPIClientWithRetry(ctx, 5)
48
    if err != nil {
49
        log.Fatalf("Failed to create workload API client: %v", err)
50
    }
51
    defer client.Close()
52

53
    sensor := &IoTSensor{
54
        client:     client,
55
        deviceID:   deviceID,
56
        sensorType: sensorType,
57
        location:   location,
58
        gatewayURL: gatewayURL,
59
    }
60

61
    // Start sensor data collection
62
    sensor.run(ctx)
63
}
64

65
func createWorkloadAPIClientWithRetry(ctx context.Context, maxRetries int) (*workloadapi.Client, error) {
66
    socketPath := getEnv("SPIFFE_ENDPOINT_SOCKET", "unix:///var/run/spire/sockets/agent.sock")
67

68
    for i := 0; i < maxRetries; i++ {
69
        client, err := workloadapi.New(ctx, workloadapi.WithAddr(socketPath))
70
        if err == nil {
71
            return client, nil
72
        }
73

74
        log.Printf("Failed to connect to SPIRE agent (attempt %d/%d): %v", i+1, maxRetries, err)
75
        time.Sleep(time.Duration(i+1) * time.Second)
76
    }
77

78
    return nil, fmt.Errorf("failed to connect to SPIRE agent after %d attempts", maxRetries)
79
}
80

81
func (s *IoTSensor) run(ctx context.Context) {
82
    // Collect and send sensor data periodically
83
    ticker := time.NewTicker(30 * time.Second)  // Every 30 seconds
84
    defer ticker.Stop()
85

86
    for {
87
        select {
88
        case <-ctx.Done():
89
            return
90
        case <-ticker.C:
91
            if err := s.collectAndSendData(ctx); err != nil {
92
                log.Printf("Error collecting/sending data: %v", err)
93
            }
94
        }
95
    }
96
}
97

98
func (s *IoTSensor) collectAndSendData(ctx context.Context) error {
99
    // Simulate sensor reading
100
    reading := s.generateSensorReading()
101

102
    // Send data to edge gateway with mTLS
103
    return s.sendToGateway(ctx, reading)
104
}
105

106
func (s *IoTSensor) generateSensorReading() SensorReading {
107
    var value float64
108
    var unit string
109

110
    // Generate realistic sensor data based on type
111
    switch s.sensorType {
112
    case "temperature":
113
        value = 20.0 + rand.Float64()*15.0  // 20-35°C
114
        unit = "celsius"
115
    case "humidity":
116
        value = 30.0 + rand.Float64()*40.0  // 30-70%
117
        unit = "percent"
118
    case "pressure":
119
        value = 1000.0 + rand.Float64()*50.0  // 1000-1050 hPa
120
        unit = "hPa"
121
    case "vibration":
122
        value = rand.Float64() * 10.0  // 0-10 m/s²
123
        unit = "m/s²"
124
    default:
125
        value = rand.Float64() * 100.0
126
        unit = "units"
127
    }
128

129
    return SensorReading{
130
        DeviceID:   s.deviceID,
131
        SensorType: s.sensorType,
132
        Value:      value,
133
        Unit:       unit,
134
        Timestamp:  time.Now(),
135
        Location:   s.location,
136
        Status:     "normal",
137
    }
138
}
139

140
func (s *IoTSensor) sendToGateway(ctx context.Context, reading SensorReading) error {
141
    // Create TLS config with SPIFFE authentication
142
    gatewayID := spiffeid.Must("edge.company.com", "edge", "gateway", "*")
143
    tlsConfig := tlsconfig.MTLSClientConfig(s.client, s.client, tlsconfig.AuthorizeID(gatewayID))
144

145
    // Create HTTP client with SPIFFE mTLS
146
    httpClient := &http.Client{
147
        Transport: &http.Transport{
148
            TLSClientConfig: tlsConfig,
149
        },
150
        Timeout: 30 * time.Second,
151
    }
152

153
    // Prepare JSON payload
154
    payload, err := json.Marshal(reading)
155
    if err != nil {
156
        return fmt.Errorf("failed to marshal reading: %v", err)
157
    }
158

159
    // Send data to gateway
160
    url := fmt.Sprintf("%s/api/sensor-data", s.gatewayURL)
161
    resp, err := httpClient.Post(url, "application/json", bytes.NewBuffer(payload))
162
    if err != nil {
163
        return fmt.Errorf("failed to send data to gateway: %v", err)
164
    }
165
    defer resp.Body.Close()
166

167
    if resp.StatusCode != http.StatusOK {
168
        return fmt.Errorf("gateway returned non-OK status: %d", resp.StatusCode)
169
    }
170

171
    log.Printf("Sent %s reading: %.2f %s", s.sensorType, reading.Value, reading.Unit)
172
    return nil
173
}
174

175
func getEnv(key, defaultValue string) string {
176
    if value := os.Getenv(key); value != "" {
177
        return value
178
    }
179
    return defaultValue
180
}

1
package main
2

3
import (
4
    "context"
5
    "encoding/json"
6
    "fmt"
7
    "log"
8
    "net/http"
9
    "sync"
10
    "time"
11

12
    "github.com/spiffe/go-spiffe/v2/spiffeid"
13
    "github.com/spiffe/go-spiffe/v2/spiffetls/tlsconfig"
14
    "github.com/spiffe/go-spiffe/v2/workloadapi"
15
)
16

17
type EdgeGateway struct {
18
    client        *workloadapi.Client
19
    gatewayID     string
20
    region        string
21
    facility      string
22
    dataBuffer    []SensorReading
23
    bufferMutex   sync.RWMutex
24
    cloudURL      string
25
}
26

27
type SensorReading struct {
28
    DeviceID    string    `json:"device_id"`
29
    SensorType  string    `json:"sensor_type"`
30
    Value       float64   `json:"value"`
31
    Unit        string    `json:"unit"`
32
    Timestamp   time.Time `json:"timestamp"`
33
    Location    string    `json:"location"`
34
    Status      string    `json:"status"`
35
    GatewayID   string    `json:"gateway_id"`
36
    ProcessedAt time.Time `json:"processed_at"`
37
}
38

39
func main() {
40
    ctx := context.Background()
41

42
    // Get configuration
43
    gatewayID := getEnv("GATEWAY_ID", "gateway-001")
44
    region := getEnv("REGION", "us-east-1")
45
    facility := getEnv("FACILITY", "warehouse-a")
46
    cloudURL := getEnv("CLOUD_URL", "https://data-ingestion.cloud.company.com")
47

48
    // Create SPIFFE client
49
    client, err := workloadapi.New(ctx, workloadapi.WithAddr("unix:///var/run/spire/sockets/agent.sock"))
50
    if err != nil {
51
        log.Fatalf("Failed to create workload API client: %v", err)
52
    }
53
    defer client.Close()
54

55
    gateway := &EdgeGateway{
56
        client:      client,
57
        gatewayID:   gatewayID,
58
        region:      region,
59
        facility:    facility,
60
        dataBuffer:  make([]SensorReading, 0),
61
        cloudURL:    cloudURL,
62
    }
63

64
    // Start HTTP server for sensor data collection
65
    go gateway.startServer(ctx)
66

67
    // Start cloud sync process
68
    go gateway.startCloudSync(ctx)
69

70
    // Wait forever
71
    select {}
72
}
73

74
func (g *EdgeGateway) startServer(ctx context.Context) {
75
    // Create TLS config that accepts IoT sensors
76
    sensorID := spiffeid.Must("edge.company.com", "iot", "sensor", "*")
77
    tlsConfig := tlsconfig.MTLSServerConfig(g.client, g.client, tlsconfig.AuthorizeID(sensorID))
78

79
    mux := http.NewServeMux()
80
    mux.HandleFunc("/api/sensor-data", g.handleSensorData)
81
    mux.HandleFunc("/api/health", g.handleHealth)
82
    mux.HandleFunc("/api/status", g.handleStatus)
83

84
    server := &http.Server{
85
        Addr:      ":8443",
86
        TLSConfig: tlsConfig,
87
        Handler:   mux,
88
    }
89

90
    log.Printf("Edge gateway %s starting on :8443", g.gatewayID)
91
    if err := server.ListenAndServeTLS("", ""); err != nil {
92
        log.Fatalf("Gateway server failed: %v", err)
93
    }
94
}
95

96
func (g *EdgeGateway) handleSensorData(w http.ResponseWriter, r *http.Request) {
97
    if r.Method != http.MethodPost {
98
        http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
99
        return
100
    }
101

102
    // Extract sensor identity
103
    sensorID, err := g.getSensorIdentity(r)
104
    if err != nil {
105
        log.Printf("Failed to get sensor identity: %v", err)
106
        http.Error(w, "Invalid sensor identity", http.StatusUnauthorized)
107
        return
108
    }
109

110
    // Parse sensor data
111
    var reading SensorReading
112
    if err := json.NewDecoder(r.Body).Decode(&reading); err != nil {
113
        http.Error(w, "Invalid JSON payload", http.StatusBadRequest)
114
        return
115
    }
116

117
    // Enrich with gateway metadata
118
    reading.GatewayID = g.gatewayID
119
    reading.ProcessedAt = time.Now()
120

121
    // Store in buffer for cloud sync
122
    g.bufferMutex.Lock()
123
    g.dataBuffer = append(g.dataBuffer, reading)
124
    g.bufferMutex.Unlock()
125

126
    log.Printf("Received data from sensor %s: %s=%.2f%s",
127
        sensorID, reading.SensorType, reading.Value, reading.Unit)
128

129
    w.WriteHeader(http.StatusOK)
130
    json.NewEncoder(w).Encode(map[string]string{"status": "received"})
131
}
132

133
func (g *EdgeGateway) handleHealth(w http.ResponseWriter, r *http.Request) {
134
    w.Header().Set("Content-Type", "application/json")
135
    json.NewEncoder(w).Encode(map[string]interface{}{
136
        "status":     "healthy",
137
        "gateway_id": g.gatewayID,
138
        "region":     g.region,
139
        "facility":   g.facility,
140
        "timestamp":  time.Now(),
141
    })
142
}
143

144
func (g *EdgeGateway) handleStatus(w http.ResponseWriter, r *http.Request) {
145
    g.bufferMutex.RLock()
146
    bufferSize := len(g.dataBuffer)
147
    g.bufferMutex.RUnlock()
148

149
    w.Header().Set("Content-Type", "application/json")
150
    json.NewEncoder(w).Encode(map[string]interface{}{
151
        "gateway_id":    g.gatewayID,
152
        "buffer_size":   bufferSize,
153
        "last_sync":     time.Now(),  // Should track actual last sync
154
        "connectivity":  "online",    // Should check actual connectivity
155
    })
156
}
157

158
func (g *EdgeGateway) getSensorIdentity(r *http.Request) (string, error) {
159
    if r.TLS == nil || len(r.TLS.PeerCertificates) == 0 {
160
        return "", fmt.Errorf("no client certificate")
161
    }
162

163
    id, err := spiffeid.FromURI(r.TLS.PeerCertificates[0].URIs[0])
164
    if err != nil {
165
        return "", err
166
    }
167

168
    return id.String(), nil
169
}
170

171
func (g *EdgeGateway) startCloudSync(ctx context.Context) {
172
    ticker := time.NewTicker(5 * time.Minute)  // Sync every 5 minutes
173
    defer ticker.Stop()
174

175
    for {
176
        select {
177
        case <-ctx.Done():
178
            return
179
        case <-ticker.C:
180
            g.syncToCloud(ctx)
181
        }
182
    }
183
}
184

185
func (g *EdgeGateway) syncToCloud(ctx context.Context) {
186
    g.bufferMutex.Lock()
187
    if len(g.dataBuffer) == 0 {
188
        g.bufferMutex.Unlock()
189
        return
190
    }
191

192
    // Take a copy of current buffer and clear it
193
    dataToSync := make([]SensorReading, len(g.dataBuffer))
194
    copy(dataToSync, g.dataBuffer)
195
    g.dataBuffer = g.dataBuffer[:0]
196
    g.bufferMutex.Unlock()
197

198
    log.Printf("Syncing %d readings to cloud...", len(dataToSync))
199

200
    // Create TLS config for cloud communication
201
    cloudID := spiffeid.Must("cloud.company.com", "service", "data-ingestion")
202
    tlsConfig := tlsconfig.MTLSClientConfig(g.client, g.client, tlsconfig.AuthorizeID(cloudID))
203

204
    httpClient := &http.Client{
205
        Transport: &http.Transport{
206
            TLSClientConfig: tlsConfig,
207
        },
208
        Timeout: 60 * time.Second,  // Longer timeout for cloud sync
209
    }
210

211
    // Prepare batch payload
212
    payload := map[string]interface{}{
213
        "gateway_id": g.gatewayID,
214
        "region":     g.region,
215
        "facility":   g.facility,
216
        "readings":   dataToSync,
217
        "sync_time":  time.Now(),
218
    }
219

220
    payloadBytes, err := json.Marshal(payload)
221
    if err != nil {
222
        log.Printf("Failed to marshal sync payload: %v", err)
223
        return
224
    }
225

226
    // Send to cloud
227
    url := fmt.Sprintf("%s/api/edge/batch-data", g.cloudURL)
228
    resp, err := httpClient.Post(url, "application/json", bytes.NewBuffer(payloadBytes))
229
    if err != nil {
230
        log.Printf("Failed to sync to cloud: %v", err)
231
        // Re-add data to buffer for retry
232
        g.bufferMutex.Lock()
233
        g.dataBuffer = append(dataToSync, g.dataBuffer...)
234
        g.bufferMutex.Unlock()
235
        return
236
    }
237
    defer resp.Body.Close()
238

239
    if resp.StatusCode != http.StatusOK {
240
        log.Printf("Cloud sync failed with status: %d", resp.StatusCode)
241
        // Re-add data to buffer for retry
242
        g.bufferMutex.Lock()
243
        g.dataBuffer = append(dataToSync, g.dataBuffer...)
244
        g.bufferMutex.Unlock()
245
        return
246
    }
247

248
    log.Printf("Successfully synced %d readings to cloud", len(dataToSync))
249
}
250

251
func getEnv(key, defaultValue string) string {
252
    if value := os.Getenv(key); value != "" {
253
        return value
254
    }
255
    return defaultValue
256
}