1
# aws-cluster-config.yaml - AWS Production Cluster
2
apiVersion: v1
3
kind: ConfigMap
4
metadata:
5
  name: spire-server-aws-config
6
  namespace: spire-system
7
data:
8
  server.conf: |
9
    server {
10
      bind_address = "0.0.0.0"
11
      bind_port = "8081"
12
      socket_path = "/tmp/spire-server/private/api.sock"
13
      trust_domain = "aws.company.com"
14
      data_dir = "/run/spire/data"
15
      log_level = "INFO"
16

17
      # Federation configuration
18
      federation {
19
        # Bundle endpoint configuration
20
        bundle_endpoint {
21
          address = "0.0.0.0"
22
          port = 8443
23

24
          # ACL for bundle access
25
          acme {
26
            tos_accepted = true
27
            cache_dir = "/tmp/spire-server/private/acme"
28
            directory_url = "https://acme-v02.api.letsencrypt.org/directory"
29
          }
30
        }
31

32
        # Federated trust domains
33
        federates_with {
34
          "gcp.company.com" {
35
            bundle_endpoint_url = "https://spire-bundle.gcp.company.com:8443"
36
            bundle_endpoint_profile {
37
              endpoint_spiffe_id = "spiffe://gcp.company.com/spire/server"
38

39
              # Authentication method
40
              type = "https_spiffe"
41

42
              # Custom CA for verification (optional)
43
              # tls_ca_cert_path = "/etc/ssl/certs/gcp-ca.pem"
44
            }
45
          }
46

47
          "onprem.company.com" {
48
            bundle_endpoint_url = "https://spire-bundle.onprem.company.com:8443"
49
            bundle_endpoint_profile {
50
              type = "https_web"
51

52
              # Web PKI verification
53
              # tls_ca_cert_path = "/etc/ssl/certs/ca-certificates.crt"
54
            }
55
          }
56

57
          # Partner trust domain with restricted access
58
          "partner.example.com" {
59
            bundle_endpoint_url = "https://spire-bundle.partner.example.com:8443"
60
            bundle_endpoint_profile {
61
              type = "https_spiffe"
62
              endpoint_spiffe_id = "spiffe://partner.example.com/spire/server"
63
            }
64

65
            # Refresh interval for partner bundles
66
            refresh_hint = "3600s"
67
          }
68
        }
69
      }
70

71
      # CA configuration for federation
72
      ca_subject = {
73
        country = ["US"],
74
        organization = ["Company Corp"],
75
        organizational_unit = ["AWS Production"],
76
        common_name = "SPIRE Server CA - AWS",
77
      }
78

79
      # JWT issuer for cross-domain authentication
80
      jwt_issuer = "https://oidc.aws.company.com"
81
    }
82

83
    plugins {
84
      NodeAttestor "aws_iid" {
85
        plugin_data {
86
          access_key_id = "${AWS_ACCESS_KEY_ID}"
87
          secret_access_key = "${AWS_SECRET_ACCESS_KEY}"
88
          account_ids_for_verification = ["123456789012"]
89
          instance_tag_requirements = {
90
            "Environment" = ["production"]
91
            "TrustDomain" = ["aws.company.com"]
92
          }
93
        }
94
      }
95

96
      WorkloadAttestor "k8s" {
97
        plugin_data {
98
          skip_kubelet_verification = false
99
          kubelet_secure_port = 10250
100
        }
101
      }
102

103
      DataStore "sql" {
104
        plugin_data {
105
          database_type = "postgres"
106
          connection_string = "host=postgres-aws.data.svc.cluster.local dbname=spire user=spire sslmode=require"
107
        }
108
      }
109

110
      KeyManager "aws_kms" {
111
        plugin_data {
112
          key_id = "arn:aws:kms:us-east-1:123456789012:key/aws-spire-key"
113
          region = "us-east-1"
114
        }
115
      }
116

117
      UpstreamAuthority "aws_pca" {
118
        plugin_data {
119
          certificate_authority_arn = "arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/aws-spire-ca"
120
          region = "us-east-1"
121
          validity_period_hours = 8760
122
        }
123
      }
124

125
      # Bundle endpoint notifier
126
      Notifier "k8sbundle" {
127
        plugin_data {
128
          webhook_label = "spiffe.io/webhook"
129
          config_map = "spire-bundle"
130
          config_map_key = "bundle.crt"
131
          namespace = "spire-system"
132
        }
133
      }
134
    }
135
---
136
# gcp-cluster-config.yaml - GCP Data Cluster
137
apiVersion: v1
138
kind: ConfigMap
139
metadata:
140
  name: spire-server-gcp-config
141
  namespace: spire-system
142
data:
143
  server.conf: |
144
    server {
145
      bind_address = "0.0.0.0"
146
      bind_port = "8081"
147
      socket_path = "/tmp/spire-server/private/api.sock"
148
      trust_domain = "gcp.company.com"
149
      data_dir = "/run/spire/data"
150
      log_level = "INFO"
151

152
      federation {
153
        bundle_endpoint {
154
          address = "0.0.0.0"
155
          port = 8443
156

157
          # GCP-specific TLS configuration
158
          tls {
159
            cert_chain_path = "/etc/ssl/spire/bundle-endpoint.crt"
160
            private_key_path = "/etc/ssl/spire/bundle-endpoint.key"
161
            ca_cert_path = "/etc/ssl/spire/ca.crt"
162
          }
163
        }
164

165
        federates_with {
166
          "aws.company.com" {
167
            bundle_endpoint_url = "https://spire-bundle.aws.company.com:8443"
168
            bundle_endpoint_profile {
169
              type = "https_spiffe"
170
              endpoint_spiffe_id = "spiffe://aws.company.com/spire/server"
171
            }
172
          }
173

174
          "onprem.company.com" {
175
            bundle_endpoint_url = "https://spire-bundle.onprem.company.com:8443"
176
            bundle_endpoint_profile {
177
              type = "https_web"
178
            }
179
          }
180
        }
181
      }
182

183
      ca_subject = {
184
        country = ["US"],
185
        organization = ["Company Corp"],
186
        organizational_unit = ["GCP Data Processing"],
187
        common_name = "SPIRE Server CA - GCP",
188
      }
189

190
      jwt_issuer = "https://oidc.gcp.company.com"
191
    }
192

193
    plugins {
194
      NodeAttestor "gcp_iit" {
195
        plugin_data {
196
          projectid_whitelist = ["company-gcp-data"]
197
          service_account_whitelist = [
198
            "spire-agent@company-gcp-data.iam.gserviceaccount.com"
199
          ]
200
          zone_whitelist = ["us-central1-a", "us-central1-b"]
201
        }
202
      }
203

204
      WorkloadAttestor "k8s" {
205
        plugin_data {
206
          skip_kubelet_verification = false
207
          kubelet_secure_port = 10250
208
        }
209
      }
210

211
      DataStore "sql" {
212
        plugin_data {
213
          database_type = "postgres"
214
          connection_string = "host=postgres-gcp.data.svc.cluster.local dbname=spire user=spire sslmode=require"
215
        }
216
      }
217

218
      KeyManager "gcp_kms" {
219
        plugin_data {
220
          key_name = "projects/company-gcp-data/locations/us-central1/keyRings/spire/cryptoKeys/spire-server"
221
        }
222
      }
223

224
      UpstreamAuthority "gcp_cas" {
225
        plugin_data {
226
          ca_name = "projects/company-gcp-data/locations/us-central1/certificateAuthorities/spire-ca"
227
          validity_period_hours = 8760
228
        }
229
      }
230
    }
231
---
232
# onprem-cluster-config.yaml - On-Premises Edge Cluster
233
apiVersion: v1
234
kind: ConfigMap
235
metadata:
236
  name: spire-server-onprem-config
237
  namespace: spire-system
238
data:
239
  server.conf: |
240
    server {
241
      bind_address = "0.0.0.0"
242
      bind_port = "8081"
243
      socket_path = "/tmp/spire-server/private/api.sock"
244
      trust_domain = "onprem.company.com"
245
      data_dir = "/run/spire/data"
246
      log_level = "INFO"
247

248
      federation {
249
        bundle_endpoint {
250
          address = "0.0.0.0"
251
          port = 8443
252

253
          # On-premises certificate management
254
          tls {
255
            cert_chain_path = "/etc/ssl/spire/server.crt"
256
            private_key_path = "/etc/ssl/spire/server.key"
257
            ca_cert_path = "/etc/ssl/spire/ca.crt"
258
          }
259

260
          # Access control for on-premises
261
          acl {
262
            authorized_keys = [
263
              "/etc/ssl/spire/federation-client.pub"
264
            ]
265
          }
266
        }
267

268
        federates_with {
269
          "aws.company.com" {
270
            bundle_endpoint_url = "https://spire-bundle.aws.company.com:8443"
271
            bundle_endpoint_profile {
272
              type = "https_spiffe"
273
              endpoint_spiffe_id = "spiffe://aws.company.com/spire/server"
274
            }
275
          }
276

277
          "gcp.company.com" {
278
            bundle_endpoint_url = "https://spire-bundle.gcp.company.com:8443"
279
            bundle_endpoint_profile {
280
              type = "https_spiffe"
281
              endpoint_spiffe_id = "spiffe://gcp.company.com/spire/server"
282
            }
283
          }
284
        }
285
      }
286

287
      ca_subject = {
288
        country = ["US"],
289
        organization = ["Company Corp"],
290
        organizational_unit = ["On-Premises Operations"],
291
        common_name = "SPIRE Server CA - OnPrem",
292
      }
293

294
      jwt_issuer = "https://oidc.onprem.company.com"
295
    }
296

297
    plugins {
298
      NodeAttestor "join_token" {
299
        plugin_data = {}
300
      }
301

302
      WorkloadAttestor "k8s" {
303
        plugin_data {
304
          skip_kubelet_verification = false
305
          kubelet_secure_port = 10250
306
        }
307
      }
308

309
      WorkloadAttestor "unix" {
310
        plugin_data {
311
          discover_workload_path = true
312
        }
313
      }
314

315
      DataStore "sql" {
316
        plugin_data {
317
          database_type = "postgres"
318
          connection_string = "host=postgres-onprem.data.svc.cluster.local dbname=spire user=spire sslmode=require"
319
        }
320
      }
321

322
      KeyManager "disk" {
323
        plugin_data {
324
          keys_path = "/run/spire/data/keys.json"
325
        }
326
      }
327

328
      UpstreamAuthority "disk" {
329
        plugin_data {
330
          cert_file_path = "/run/spire/ca/ca.crt"
331
          key_file_path = "/run/spire/ca/ca.key"
332
        }
333
      }
334
    }

1
# aws-frontend-deployment.yaml - Deployed in AWS cluster
2
apiVersion: v1
3
kind: Namespace
4
metadata:
5
  name: distributed-app
6
  labels:
7
    federation: enabled
8
---
9
apiVersion: v1
10
kind: ServiceAccount
11
metadata:
12
  name: frontend-service
13
  namespace: distributed-app
14
---
15
apiVersion: apps/v1
16
kind: Deployment
17
metadata:
18
  name: frontend
19
  namespace: distributed-app
20
spec:
21
  replicas: 3
22
  selector:
23
    matchLabels:
24
      app: frontend
25
      service: frontend
26
  template:
27
    metadata:
28
      labels:
29
        app: frontend
30
        service: frontend
31
        component: frontend
32
        version: v1
33
    spec:
34
      serviceAccountName: frontend-service
35
      containers:
36
        - name: frontend
37
          image: company/frontend:v1.2.3
38
          ports:
39
            - containerPort: 8080
40
          env:
41
            # SPIFFE configuration
42
            - name: SPIFFE_ENDPOINT_SOCKET
43
              value: "unix:///run/spire/sockets/agent.sock"
44
            - name: TRUST_DOMAIN
45
              value: "aws.company.com"
46
            # Service endpoints in other clusters
47
            - name: DATA_SERVICE_URL
48
              value: "https://data.gcp.company.com:8443"
49
            - name: LEGACY_SERVICE_URL
50
              value: "https://legacy.onprem.company.com:8443"
51
          volumeMounts:
52
            - name: spire-agent-socket
53
              mountPath: /run/spire/sockets
54
              readOnly: true
55
      volumes:
56
        - name: spire-agent-socket
57
          hostPath:
58
            path: /run/spire/sockets
59
            type: DirectoryOrCreate
60
---
61
apiVersion: v1
62
kind: Service
63
metadata:
64
  name: frontend
65
  namespace: distributed-app
66
spec:
67
  selector:
68
    app: frontend
69
  ports:
70
    - port: 8080
71
      targetPort: 8080
72
      name: http
73
  type: LoadBalancer

1
# gcp-data-service-deployment.yaml - Deployed in GCP cluster
2
apiVersion: v1
3
kind: Namespace
4
metadata:
5
  name: distributed-app
6
  labels:
7
    federation: enabled
8
---
9
apiVersion: v1
10
kind: ServiceAccount
11
metadata:
12
  name: data-service
13
  namespace: distributed-app
14
---
15
apiVersion: apps/v1
16
kind: Deployment
17
metadata:
18
  name: data-service
19
  namespace: distributed-app
20
spec:
21
  replicas: 2
22
  selector:
23
    matchLabels:
24
      app: data-service
25
      service: data-processing
26
  template:
27
    metadata:
28
      labels:
29
        app: data-service
30
        service: data-processing
31
        component: data-processing
32
        version: v2
33
    spec:
34
      serviceAccountName: data-service
35
      containers:
36
        - name: data-service
37
          image: company/data-service:v2.1.0
38
          ports:
39
            - containerPort: 8443
40
          env:
41
            - name: SPIFFE_ENDPOINT_SOCKET
42
              value: "unix:///run/spire/sockets/agent.sock"
43
            - name: TRUST_DOMAIN
44
              value: "gcp.company.com"
45
            # Allowed client trust domains
46
            - name: ALLOWED_CLIENT_TRUST_DOMAINS
47
              value: "aws.company.com,onprem.company.com"
48
            # Legacy system endpoint
49
            - name: LEGACY_DB_URL
50
              value: "https://database.onprem.company.com:5432"
51
          volumeMounts:
52
            - name: spire-agent-socket
53
              mountPath: /run/spire/sockets
54
              readOnly: true
55
      volumes:
56
        - name: spire-agent-socket
57
          hostPath:
58
            path: /run/spire/sockets
59
            type: DirectoryOrCreate
60
---
61
apiVersion: v1
62
kind: Service
63
metadata:
64
  name: data-service
65
  namespace: distributed-app
66
spec:
67
  selector:
68
    app: data-service
69
  ports:
70
    - port: 8443
71
      targetPort: 8443
72
      name: https

1
# onprem-legacy-bridge-deployment.yaml - Deployed in on-premises cluster
2
apiVersion: v1
3
kind: Namespace
4
metadata:
5
  name: distributed-app
6
  labels:
7
    federation: enabled
8
---
9
apiVersion: v1
10
kind: ServiceAccount
11
metadata:
12
  name: legacy-bridge
13
  namespace: distributed-app
14
---
15
apiVersion: apps/v1
16
kind: Deployment
17
metadata:
18
  name: legacy-bridge
19
  namespace: distributed-app
20
spec:
21
  replicas: 1
22
  selector:
23
    matchLabels:
24
      app: legacy-bridge
25
      system: mainframe-bridge
26
  template:
27
    metadata:
28
      labels:
29
        app: legacy-bridge
30
        system: mainframe-bridge
31
        component: legacy-bridge
32
        datacenter: primary
33
    spec:
34
      serviceAccountName: legacy-bridge
35
      containers:
36
        - name: legacy-bridge
37
          image: company/legacy-bridge:v1.0.5
38
          ports:
39
            - containerPort: 8443
40
            - containerPort: 5432 # Database proxy port
41
          env:
42
            - name: SPIFFE_ENDPOINT_SOCKET
43
              value: "unix:///run/spire/sockets/agent.sock"
44
            - name: TRUST_DOMAIN
45
              value: "onprem.company.com"
46
            # Cloud service endpoints that can access this bridge
47
            - name: ALLOWED_CLIENT_TRUST_DOMAINS
48
              value: "aws.company.com,gcp.company.com"
49
            # Legacy system configuration
50
            - name: MAINFRAME_HOST
51
              value: "mainframe.internal.company.com"
52
            - name: DATABASE_HOST
53
              value: "db-cluster.internal.company.com"
54
          volumeMounts:
55
            - name: spire-agent-socket
56
              mountPath: /run/spire/sockets
57
              readOnly: true
58
            # Mount legacy certificates for backward compatibility
59
            - name: legacy-certs
60
              mountPath: /etc/ssl/legacy
61
              readOnly: true
62
      volumes:
63
        - name: spire-agent-socket
64
          hostPath:
65
            path: /run/spire/sockets
66
            type: DirectoryOrCreate
67
        - name: legacy-certs
68
          secret:
69
            secretName: legacy-system-certs
70
---
71
apiVersion: v1
72
kind: Service
73
metadata:
74
  name: legacy-bridge
75
  namespace: distributed-app
76
spec:
77
  selector:
78
    app: legacy-bridge
79
  ports:
80
    - port: 8443
81
      targetPort: 8443
82
      name: https
83
    - port: 5432
84
      targetPort: 5432
85
      name: database

1
// frontend-service.go - AWS Frontend Service
2
package main
3

4
import (
5
    "context"
6
    "crypto/tls"
7
    "fmt"
8
    "io"
9
    "net/http"
10
    "time"
11

12
    "github.com/spiffe/go-spiffe/v2/spiffeid"
13
    "github.com/spiffe/go-spiffe/v2/spiffetls"
14
    "github.com/spiffe/go-spiffe/v2/spiffetls/tlsconfig"
15
    "github.com/spiffe/go-spiffe/v2/workloadapi"
16
)
17

18
func main() {
19
    ctx := context.Background()
20

21
    // Create Workload API client
22
    client, err := workloadapi.New(ctx, workloadapi.WithAddr("unix:///run/spire/sockets/agent.sock"))
23
    if err != nil {
24
        panic(fmt.Sprintf("Failed to create workload API client: %v", err))
25
    }
26
    defer client.Close()
27

28
    // Set up HTTP server for incoming requests
29
    go startHTTPServer(client)
30

31
    // Example: Call GCP data service
32
    callGCPDataService(client)
33

34
    // Example: Call on-premises legacy service
35
    callOnPremLegacyService(client)
36

37
    select {} // Keep running
38
}
39

40
func startHTTPServer(client *workloadapi.Client) {
41
    // Create TLS config that accepts requests from any federated trust domain
42
    tlsConfig := tlsconfig.MTLSServerConfig(client, client, tlsconfig.AuthorizeAny())
43

44
    server := &http.Server{
45
        Addr:      ":8080",
46
        TLSConfig: tlsConfig,
47
        Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
48
            // Extract client identity from certificate
49
            if r.TLS != nil && len(r.TLS.PeerCertificates) > 0 {
50
                clientID, err := spiffeid.FromURI(r.TLS.PeerCertificates[0].URIs[0])
51
                if err == nil {
52
                    fmt.Printf("Request from: %s\n", clientID)
53

54
                    // Make decisions based on client trust domain
55
                    switch clientID.TrustDomain().String() {
56
                    case "gcp.company.com":
57
                        w.Header().Set("Content-Type", "application/json")
58
                        fmt.Fprintf(w, `{"message": "Hello from AWS frontend", "client": "%s"}`, clientID)
59
                    case "onprem.company.com":
60
                        w.Header().Set("Content-Type", "application/json")
61
                        fmt.Fprintf(w, `{"message": "Legacy system acknowledged", "client": "%s"}`, clientID)
62
                    default:
63
                        http.Error(w, "Unauthorized trust domain", http.StatusForbidden)
64
                    }
65
                    return
66
                }
67
            }
68
            http.Error(w, "No valid client certificate", http.StatusUnauthorized)
69
        }),
70
    }
71

72
    fmt.Println("Frontend server starting on :8080...")
73
    if err := server.ListenAndServeTLS("", ""); err != nil {
74
        panic(fmt.Sprintf("Server failed: %v", err))
75
    }
76
}
77

78
func callGCPDataService(client *workloadapi.Client) {
79
    // Create TLS config for calling GCP data service
80
    gcpDataID := spiffeid.Must("gcp.company.com", "ns", "distributed-app", "service", "data-processing")
81
    tlsConfig := tlsconfig.MTLSClientConfig(client, client, tlsconfig.AuthorizeID(gcpDataID))
82

83
    httpClient := &http.Client{
84
        Transport: &http.Transport{
85
            TLSClientConfig: tlsConfig,
86
        },
87
        Timeout: 30 * time.Second,
88
    }
89

90
    // Make authenticated request to GCP data service
91
    resp, err := httpClient.Get("https://data.gcp.company.com:8443/api/process-data")
92
    if err != nil {
93
        fmt.Printf("Failed to call GCP data service: %v\n", err)
94
        return
95
    }
96
    defer resp.Body.Close()
97

98
    body, _ := io.ReadAll(resp.Body)
99
    fmt.Printf("GCP Data Service Response: %s\n", body)
100
}
101

102
func callOnPremLegacyService(client *workloadapi.Client) {
103
    // Create TLS config for calling on-premises legacy bridge
104
    onPremID := spiffeid.Must("onprem.company.com", "datacenter", "primary", "system", "mainframe-bridge")
105
    tlsConfig := tlsconfig.MTLSClientConfig(client, client, tlsconfig.AuthorizeID(onPremID))
106

107
    httpClient := &http.Client{
108
        Transport: &http.Transport{
109
            TLSClientConfig: tlsConfig,
110
        },
111
        Timeout: 60 * time.Second, // Longer timeout for legacy systems
112
    }
113

114
    // Make authenticated request to on-premises legacy bridge
115
    resp, err := httpClient.Get("https://legacy.onprem.company.com:8443/api/legacy-data")
116
    if err != nil {
117
        fmt.Printf("Failed to call on-premises legacy service: %v\n", err)
118
        return
119
    }
120
    defer resp.Body.Close()
121

122
    body, _ := io.ReadAll(resp.Body)
123
    fmt.Printf("On-Premises Legacy Service Response: %s\n", body)
124
}

1
// data-service.go - GCP Data Service
2
package main
3

4
import (
5
    "context"
6
    "database/sql"
7
    "encoding/json"
8
    "fmt"
9
    "net/http"
10
    "strings"
11
    "time"
12

13
    "github.com/spiffe/go-spiffe/v2/spiffeid"
14
    "github.com/spiffe/go-spiffe/v2/spiffetls/tlsconfig"
15
    "github.com/spiffe/go-spiffe/v2/workloadapi"
16
    _ "github.com/lib/pq"
17
)
18

19
type DataService struct {
20
    client   *workloadapi.Client
21
    database *sql.DB
22
}
23

24
func main() {
25
    ctx := context.Background()
26

27
    // Create Workload API client
28
    client, err := workloadapi.New(ctx, workloadapi.WithAddr("unix:///run/spire/sockets/agent.sock"))
29
    if err != nil {
30
        panic(fmt.Sprintf("Failed to create workload API client: %v", err))
31
    }
32
    defer client.Close()
33

34
    // Connect to database (simulated)
35
    db, err := sql.Open("postgres", "host=db-cluster.data.svc.cluster.local dbname=analytics user=dataservice sslmode=require")
36
    if err != nil {
37
        panic(fmt.Sprintf("Failed to connect to database: %v", err))
38
    }
39
    defer db.Close()
40

41
    service := &DataService{
42
        client:   client,
43
        database: db,
44
    }
45

46
    service.startServer()
47
}
48

49
func (ds *DataService) startServer() {
50
    // Create TLS config that accepts federated clients
51
    allowedClients := []spiffeid.ID{
52
        spiffeid.Must("aws.company.com", "ns", "distributed-app", "service", "frontend"),
53
        spiffeid.Must("onprem.company.com", "datacenter", "primary", "system", "mainframe-bridge"),
54
    }
55

56
    tlsConfig := tlsconfig.MTLSServerConfig(ds.client, ds.client, tlsconfig.AuthorizeOneOf(allowedClients...))
57

58
    mux := http.NewServeMux()
59
    mux.HandleFunc("/api/process-data", ds.processDataHandler)
60
    mux.HandleFunc("/api/health", ds.healthHandler)
61

62
    server := &http.Server{
63
        Addr:      ":8443",
64
        TLSConfig: tlsConfig,
65
        Handler:   mux,
66
    }
67

68
    fmt.Println("GCP Data Service starting on :8443...")
69
    if err := server.ListenAndServeTLS("", ""); err != nil {
70
        panic(fmt.Sprintf("Server failed: %v", err))
71
    }
72
}
73

74
func (ds *DataService) processDataHandler(w http.ResponseWriter, r *http.Request) {
75
    // Extract and validate client identity
76
    clientID, err := ds.getClientIdentity(r)
77
    if err != nil {
78
        http.Error(w, "Invalid client identity", http.StatusUnauthorized)
79
        return
80
    }
81

82
    fmt.Printf("Processing data request from: %s\n", clientID)
83

84
    // Different processing based on client trust domain
85
    var response map[string]interface{}
86

87
    switch clientID.TrustDomain().String() {
88
    case "aws.company.com":
89
        // AWS frontend gets aggregated data
90
        response = map[string]interface{}{
91
            "type":      "aggregated",
92
            "data":      ds.getAggregatedData(),
93
            "source":    "gcp.company.com",
94
            "client":    clientID.String(),
95
            "timestamp": time.Now().Unix(),
96
        }
97

98
    case "onprem.company.com":
99
        // On-premises gets raw data for legacy processing
100
        response = map[string]interface{}{
101
            "type":      "raw",
102
            "data":      ds.getRawDataForLegacy(),
103
            "source":    "gcp.company.com",
104
            "client":    clientID.String(),
105
            "timestamp": time.Now().Unix(),
106
        }
107

108
    default:
109
        http.Error(w, "Unauthorized trust domain", http.StatusForbidden)
110
        return
111
    }
112

113
    w.Header().Set("Content-Type", "application/json")
114
    json.NewEncoder(w).Encode(response)
115
}
116

117
func (ds *DataService) healthHandler(w http.ResponseWriter, r *http.Request) {
118
    w.Header().Set("Content-Type", "application/json")
119
    json.NewEncoder(w).Encode(map[string]string{
120
        "status":       "healthy",
121
        "trust_domain": "gcp.company.com",
122
        "service":      "data-processing",
123
    })
124
}
125

126
func (ds *DataService) getClientIdentity(r *http.Request) (spiffeid.ID, error) {
127
    if r.TLS == nil || len(r.TLS.PeerCertificates) == 0 {
128
        return spiffeid.ID{}, fmt.Errorf("no client certificate")
129
    }
130

131
    return spiffeid.FromURI(r.TLS.PeerCertificates[0].URIs[0])
132
}
133

134
func (ds *DataService) getAggregatedData() interface{} {
135
    // Simulate aggregated data processing
136
    return map[string]interface{}{
137
        "total_records": 15420,
138
        "categories":    []string{"analytics", "ml-training", "reporting"},
139
        "processed_at":  time.Now().Format(time.RFC3339),
140
    }
141
}
142

143
func (ds *DataService) getRawDataForLegacy() interface{} {
144
    // Simulate raw data for legacy systems
145
    return map[string]interface{}{
146
        "records": []map[string]interface{}{
147
            {"id": 1, "value": "legacy-compatible-data-1"},
148
            {"id": 2, "value": "legacy-compatible-data-2"},
149
        },
150
        "format": "legacy-v1",
151
    }
152
}