feat: SPIRE sds coverage

spire/README_test_coverage.md

@@ -30,7 +30,7 @@ cargo test -p cosmian_kms_server -- kmip_policy
 | **PKI-07** | Approved algorithm restriction | High | ✅ Existing | `mise run test:spire` step 13 (bogus transit key type → 4xx) + unit tests above |
 | **PKI-08** | Storage policy enforcement | Medium | ✅ Existing | `mise run test:spire` step 12 Scenario 5 (Sensitive key export denied) |
 | **PKI-09** | PAM integration for long-lived secrets | Medium | 🔶 Joint workshop | Requires live Segura instance; see `client.txt` I-3 for integration design |
-| **PKI-10** | Service mesh SDS delivery | Medium | 🔶 Aembit/Envoy | Envoy SDS is the delivery layer; KMS provides the SVID via SPIRE |
+| **PKI-10** | Service mesh SDS delivery | Medium | ✅ **New** | `mise run test:spire-sds` — Envoy upstream+downstream fetch X.509-SVIDs from SPIRE SDS (no static certs); mTLS probe validates delivery |
 | **PKI-11** | TLS 1.3 enforcement | High | ✅ **Enhanced** (M-02) | `test_pki.sh` M-02 — TLS 1.1 rejected (hard), TLS 1.2 accepted (migration), TLS 1.3 verified |
 | **PKI-12** | Algorithm policy change without redeploy | High | ✅ **Enhanced** (M-03) | `test_pki.sh` M-03 — baseline P-256 allowed → restricted KMS blocks P-256, allows P-384 via KMIP |
 | **PKI-13** | Documented PKI responsibility split | High | 📄 Documentation | See `client.txt` PKI-2 section (written answer) |

spire/certs/auth.crt

@@ -1,15 +1,15 @@
 -----BEGIN CERTIFICATE-----
-MIICTTCCAdOgAwIBAgIUc5vSLlGErz3XyG9DGTMp/Vu++6IwCgYIKoZIzj0EAwIw
+MIICTTCCAdOgAwIBAgIUc5vSLlGErz3XyG9DGTMp/Vu++6UwCgYIKoZIzj0EAwIw
 OTEYMBYGA1UEAwwPQ29zbWlhbiBUZXN0IENBMRAwDgYDVQQKDAdDb3NtaWFuMQsw
-CQYDVQQGEwJGUjAeFw0yNjA3MjcxMzUwNDRaFw0zNjA3MjQxMzUwNDRaMC4xDTAL
+CQYDVQQGEwJGUjAeFw0yNjA4MjEwNDA5NTFaFw0zNjA4MTgwNDA5NTFaMC4xDTAL
 BgNVBAMMBGF1dGgxEDAOBgNVBAoMB0Nvc21pYW4xCzAJBgNVBAYTAkZSMHYwEAYH
-KoZIzj0CAQYFK4EEACIDYgAEO6UuOXduwQs7mKTyXZ87aVVGAu2KSIZWvSr+rghW
-RKrB9O2wVDfoEWVwnO3mn6aOj1gx+W4wxmTVaEKBKksXp0IBrBsHkrQB5oiz9UBH
-gMO6T8kiabfJxd1/L8plaL35o4GmMIGjMD8GA1UdEQQ4MDaCDWF1dGgtdmVyaWZp
+KoZIzj0CAQYFK4EEACIDYgAEg435mnDfUISi0bom5c3z3GBTwArSW6BevZrto1/b
+SVZfvPWZQ1DoX7bEmHpii3+rbLBjArO7uPdW21AU0hEvUW0Mlmy2+emhG/MnR4Es
+nPJ7y8mT3qvihMRQhx3FRTnTo4GmMIGjMD8GA1UdEQQ4MDaCDWF1dGgtdmVyaWZp
 ZXKCCWxvY2FsaG9zdIIUaG9zdC5kb2NrZXIuaW50ZXJuYWyHBH8AAAEwCwYDVR0P
-BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0GA1UdDgQWBBRRp55kHLLobdaF
-XgR+JmM/E24+czAfBgNVHSMEGDAWgBQuP2dimylbbec2xfiFHXs2wcPemjAKBggq
-hkjOPQQDAgNoADBlAjA466BYVFb2qCuY5Acv/mzzdn1EpTk6/h/ZKlgvs+LVgHZ/
-oMaob/4LHeUE2w2JcAQCMQCtYws0UXDXSuOFvjyRRN9Jzs/KczJmXTJr1wXRV8Am
-Oo9C+ia0gnT+JWyvQYqN4Tw=
+BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0GA1UdDgQWBBRU6NAixx3EfvX7
++buDPMl+y492GjAfBgNVHSMEGDAWgBRKmjGoB9y61x39V8jtuzH9Tud8xDAKBggq
+hkjOPQQDAgNoADBlAjAQvPQgF50oJGc4SPKSHrp6uy1F0baQ0dgXhFOb5c9jdEOl
+DttaT+pgKleJJlkYy6ECMQDydwiKQV2I26+AxtBpw/0VZwnwmGUh+0rXDhFf+Olc
+Tj4c72gedxEbnSz5I9u5lFw=
 -----END CERTIFICATE-----

spire/certs/auth.key

@@ -1,6 +1,6 @@
 -----BEGIN PRIVATE KEY-----
-MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDAEXS+kiiU2l2nd9YHh
-Y74AlBf0Xr9gBnPYVFAsM23s6aJKaNwcU1EJRwRVRrjZ8wWhZANiAAQ7pS45d27B
-CzuYpPJdnztpVUYC7YpIhla9Kv6uCFZEqsH07bBUN+gRZXCc7eafpo6PWDH5bjDG
-ZNVoQoEqSxenQgGsGweStAHmiLP1QEeAw7pPySJpt8nF3X8vymVovfk=
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDDhhoboiwb0+MCXAR9B
+gDYT7EuIgi2qAtdOWVi9hS+CxC59xULUXF2aj9hsL8KgjjGhZANiAASDjfmacN9Q
+hKLRuiblzfPcYFPACtJboF69mu2jX9tJVl+89ZlDUOhftsSYemKLf6tssGMCs7u4
+91bbUBTSES9RbQyWbLb56aEb8ydHgSyc8nvLyZPeq+KExFCHHcVFOdM=
 -----END PRIVATE KEY-----

spire/certs/ca.crt

@@ -1,13 +1,13 @@
 -----BEGIN CERTIFICATE-----
-MIICBDCCAYqgAwIBAgIUYZijolSxHud/7nIW4btzH6gouHgwCgYIKoZIzj0EAwIw
+MIICBDCCAYqgAwIBAgIUXBTxTTKeykraT0+H7b3MIYganF0wCgYIKoZIzj0EAwIw
 OTEYMBYGA1UEAwwPQ29zbWlhbiBUZXN0IENBMRAwDgYDVQQKDAdDb3NtaWFuMQsw
-CQYDVQQGEwJGUjAeFw0yNjA3MjcxMzUwNDRaFw0zNjA3MjQxMzUwNDRaMDkxGDAW
+CQYDVQQGEwJGUjAeFw0yNjA4MjEwNDA5NTFaFw0zNjA4MTgwNDA5NTFaMDkxGDAW
 BgNVBAMMD0Nvc21pYW4gVGVzdCBDQTEQMA4GA1UECgwHQ29zbWlhbjELMAkGA1UE
-BhMCRlIwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATIm2ydThVulIim2wUCoRp0JyyU
-FjW/CrvEhvrKrS4tRJZsy4eU1iBPUwDVlKCjJovLELF8Qn+kdI60RYsLr9phw+QD
-t864LNQPi3MkY55CSRwCZTCT5T5EWAKsoli77W2jUzBRMB0GA1UdDgQWBBQuP2di
-mylbbec2xfiFHXs2wcPemjAfBgNVHSMEGDAWgBQuP2dimylbbec2xfiFHXs2wcPe
-mjAPBgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA2gAMGUCMQCTx8B+rvbEnfKd
-tZCXxiqW+ks6dOpKIkLCYLZ5ZWGFzo8OXzmTgTRz0TXcDoM9+JcCMD95/52/c9Ga
-RrcJ/Ow862HqobulA1B0LuGlwOk7QnnNWsY2VPJAQdiLL/F+WB+ozw==
+BhMCRlIwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATjocDKNR41SFlyAzofOEurPJ9+
+tCpXDiCyoiLMEBv0JFYd2dHo+ZzM+mrEGXvuP/UOpD1+6I+iOxSV00RbyTVvxd1R
+0VKUAj7MQ+GeikBw2/gi8duLFUEEaHdG9RChPAOjUzBRMB0GA1UdDgQWBBRKmjGo
+B9y61x39V8jtuzH9Tud8xDAfBgNVHSMEGDAWgBRKmjGoB9y61x39V8jtuzH9Tud8
+xDAPBgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA2gAMGUCMD+T3t2p20o6Lxua
+a+Nhmr8W9MNwr+bNHwf8ZMk/d7KSp7IpIZzKqpJensg5vCL+nwIxAMdMFPvITCdK
+kpN2fzyXCqSO8rK4ludMs3WqoOJz1rhX1m3wBKDalUzJSw/9YsPCWQ==
 -----END CERTIFICATE-----

spire/certs/ca.key

@@ -1,6 +1,6 @@
 -----BEGIN PRIVATE KEY-----
-MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDBpEq4CXf01x9TqPzLu
-vlczGv9TdF8A2aVq8RAWrjAp04WNT2WW7VJt1OEApOMrlomhZANiAATIm2ydThVu
-lIim2wUCoRp0JyyUFjW/CrvEhvrKrS4tRJZsy4eU1iBPUwDVlKCjJovLELF8Qn+k
-dI60RYsLr9phw+QDt864LNQPi3MkY55CSRwCZTCT5T5EWAKsoli77W0=
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDAgcjR8FbInMEeOTXXU
+23hZygQplgsvNY4sPZxXm78fN1DxEuzhYw8889RRyO6kpQ2hZANiAATjocDKNR41
+SFlyAzofOEurPJ9+tCpXDiCyoiLMEBv0JFYd2dHo+ZzM+mrEGXvuP/UOpD1+6I+i
+OxSV00RbyTVvxd1R0VKUAj7MQ+GeikBw2/gi8duLFUEEaHdG9RChPAM=
 -----END PRIVATE KEY-----

spire/certs/ca.srl

@@ -1 +1 @@
-739BD22E5184AF3DD7C86F43193329FD5BBEFBA4
+739BD22E5184AF3DD7C86F43193329FD5BBEFBA7

spire/certs/generate-test-certs.sh

@@ -81,3 +81,22 @@ echo "  ca.crt              — root CA (import into containers)"
 echo "  auth.crt/key        — auth-verifier TLS (SANs: auth-verifier, localhost, host.docker.internal)"
 echo "  kms.crt/key         — KMS TLS (SANs: cosmian-kms, localhost, host.docker.internal)"
 echo "  jwt.key.pem/jwt.pub.pem — P-256 JWT signing key for auth-verifier"
+
+# ── mTLS client certificate for SPIRE → KMS ──────────────────────────────────
+# Used by the eviden_kms KeyManager and UpstreamAuthority plugins to authenticate
+# to the KMS via mutual TLS. The KMS server validates this cert against ca.crt.
+# The cert carries CN=spire-client and extendedKeyUsage=clientAuth.
+openssl req -newkey ec -pkeyopt ec_paramgen_curve:P-384 \
+  -keyout "${DIR}/spire-client.key" \
+  -out "${DIR}/spire-client.csr" \
+  -nodes -subj "/CN=spire-client/O=SPIFFE/C=US"
+
+openssl x509 -req \
+  -in "${DIR}/spire-client.csr" \
+  -CA "${DIR}/ca.crt" -CAkey "${DIR}/ca.key" -CAcreateserial \
+  -out "${DIR}/spire-client.crt" \
+  -days 3650 \
+  -extfile <(printf "keyUsage=digitalSignature\nextendedKeyUsage=clientAuth")
+
+rm -f "${DIR}/spire-client.csr"
+echo "issued: spire-client.crt (mTLS client cert for SPIRE → KMS)"

spire/certs/jwt.key.pem

@@ -1,5 +1,5 @@
 -----BEGIN PRIVATE KEY-----
-MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgJlm5/hdh7KduIpgT
-5X/TLIDTgk2lRNstTyUPvc6/avahRANCAATFWuGQTRP/eFrZYlRL4suSD4xQFe/y
-i+lolCaFKb+81OtoQUPdLNY8keTpQh9y3d51nvLfKQW/h2M/BXKNU90u
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQggrfSXlYh/zuAr2vI
+1Ki0Xq1/R/s7nKQNZoSDjplhBNihRANCAARe/JcGhUHidLeOVgWcKgpbbXN2VFsY
+8E7YFZc8ZeejvqQlWBMSlOrvNUy6f4xPHr13OUyfsZuAUmWchwcvsg3x
 -----END PRIVATE KEY-----

spire/certs/jwt.pub.pem

@@ -1,4 +1,4 @@
 -----BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExVrhkE0T/3ha2WJUS+LLkg+MUBXv
-8ovpaJQmhSm/vNTraEFD3SzWPJHk6UIfct3edZ7y3ykFv4djPwVyjVPdLg==
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEXvyXBoVB4nS3jlYFnCoKW21zdlRb
+GPBO2BWXPGXno76kJVgTEpTq7zVMun+MTx69dzlMn7GbgFJlnIcHL7IN8Q==
 -----END PUBLIC KEY-----

spire/certs/kms.crt

@@ -1,15 +1,15 @@
 -----BEGIN CERTIFICATE-----
-MIICSjCCAdCgAwIBAgIUc5vSLlGErz3XyG9DGTMp/Vu++6MwCgYIKoZIzj0EAwIw
+MIICSTCCAdCgAwIBAgIUc5vSLlGErz3XyG9DGTMp/Vu++6YwCgYIKoZIzj0EAwIw
 OTEYMBYGA1UEAwwPQ29zbWlhbiBUZXN0IENBMRAwDgYDVQQKDAdDb3NtaWFuMQsw
-CQYDVQQGEwJGUjAeFw0yNjA3MjcxMzUwNDRaFw0zNjA3MjQxMzUwNDRaMC0xDDAK
+CQYDVQQGEwJGUjAeFw0yNjA4MjEwNDA5NTFaFw0zNjA4MTgwNDA5NTFaMC0xDDAK
 BgNVBAMMA2ttczEQMA4GA1UECgwHQ29zbWlhbjELMAkGA1UEBhMCRlIwdjAQBgcq
-hkjOPQIBBgUrgQQAIgNiAARbPmkCG+qR+PMKJKM3NQQISyxWzVnPw0y5ittAWbeA
-gLM041bzlnU0MOdDg1f1dXy/+Pdr5y4p+OYjObuZukAJjTuIj/UgCbMbNOz0jEw7
-fSsElsHvRft3Kja4Og69mXKjgaQwgaEwPQYDVR0RBDYwNIILY29zbWlhbi1rbXOC
+hkjOPQIBBgUrgQQAIgNiAASN2GWqrm0i7A6lkmZixf67ja1jm07PT8oVPusHcqZK
+22CXbRXX4jBiL6kZIAk2MjN6w59vIQH568CytsBcPUrjzWDcNud5U4dKGZEJRX2S
+haJc6tsdnI/dW3xpYZogF2ejgaQwgaEwPQYDVR0RBDYwNIILY29zbWlhbi1rbXOC
 CWxvY2FsaG9zdIIUaG9zdC5kb2NrZXIuaW50ZXJuYWyHBH8AAAEwCwYDVR0PBAQD
-AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0GA1UdDgQWBBTzvMGJy4Xu5iapZVDt
-oaZihQLQQDAfBgNVHSMEGDAWgBQuP2dimylbbec2xfiFHXs2wcPemjAKBggqhkjO
-PQQDAgNoADBlAjBbMI4ydOQTyAoJwxXd9Sw3fYCrjXuGxnlDTPMYLiNPhbF2zChk
-SQ+c/JDUqJgdudgCMQCCrX+TJp9ucIEq4pRrMiw4yH/1BOfleeWn1brfAFh28hP+
-eU56XgREvWURHyjj/eM=
+AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0GA1UdDgQWBBTnzfbO7MTY8dZdmqcE
+BwQSwbBPfjAfBgNVHSMEGDAWgBRKmjGoB9y61x39V8jtuzH9Tud8xDAKBggqhkjO
+PQQDAgNnADBkAjBR5v/Zk+9JvPDGVyaZRpC8AlMdB1YPv+X2Qoua04jSDRMGJWbV
+BzptG3GEwsDMkIQCMBLN4OktUMGRs3WCC4bLc/ZZ5X1TpqBLfLf+5JopI7LB13mr
+GdRbYV0PMMw86G45mQ==
 -----END CERTIFICATE-----

spire/certs/kms.key

@@ -1,6 +1,6 @@
 -----BEGIN PRIVATE KEY-----
-MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDBJ09I2/HckpT/XraVc
-4vGKH+OzaOhEnd0s3/10qq4GqWW7BIO3bZ23ErQbvob9iuihZANiAARbPmkCG+qR
-+PMKJKM3NQQISyxWzVnPw0y5ittAWbeAgLM041bzlnU0MOdDg1f1dXy/+Pdr5y4p
-+OYjObuZukAJjTuIj/UgCbMbNOz0jEw7fSsElsHvRft3Kja4Og69mXI=
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDBBMNlCWFq8BvUoa4UR
+sst8eMbPOL9SLE9J7H/87dByeUR5bWMlTBpq36fxn2HrJRqhZANiAASN2GWqrm0i
+7A6lkmZixf67ja1jm07PT8oVPusHcqZK22CXbRXX4jBiL6kZIAk2MjN6w59vIQH5
+68CytsBcPUrjzWDcNud5U4dKGZEJRX2ShaJc6tsdnI/dW3xpYZogF2c=
 -----END PRIVATE KEY-----

spire/certs/spire-client.crt

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICETCCAZegAwIBAgIUc5vSLlGErz3XyG9DGTMp/Vu++6cwCgYIKoZIzj0EAwIw
+OTEYMBYGA1UEAwwPQ29zbWlhbiBUZXN0IENBMRAwDgYDVQQKDAdDb3NtaWFuMQsw
+CQYDVQQGEwJGUjAeFw0yNjA4MjEwNDA5NTFaFw0zNjA4MTgwNDA5NTFaMDUxFTAT
+BgNVBAMMDHNwaXJlLWNsaWVudDEPMA0GA1UECgwGU1BJRkZFMQswCQYDVQQGEwJV
+UzB2MBAGByqGSM49AgEGBSuBBAAiA2IABOdo3WSZq+zb3oDAkj8MyY2WdCRG3Bqp
+N9IarRLkHgxvV09gk8mxF+9nj78j9pSO9voSiCmjCfnVHL+0nRV2l9oZ2woBADLv
+RTxzw+xxhXdNFFJ5o19mFYvUAqOeLqqHVaNkMGIwCwYDVR0PBAQDAgeAMBMGA1Ud
+JQQMMAoGCCsGAQUFBwMCMB0GA1UdDgQWBBShKUc0yQ8CP9OG9csx8h52Fy+oGTAf
+BgNVHSMEGDAWgBRKmjGoB9y61x39V8jtuzH9Tud8xDAKBggqhkjOPQQDAgNoADBl
+AjAQAUAJeVEi3C1U9oJY69j4g6EtqYL83HRW8z0ggFaOq8JN8ouFy9mSHaseTgbS
+qzsCMQCGBd5QSp2t9LY17akWKcHs9kIPmu+wZI4EcjOmC5R+H3pWc/OQJlZxt3r7
+mK5wzeY=
+-----END CERTIFICATE-----

spire/certs/spire-client.key

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDCguf6yaJNUOmUshQWl
+V9turmN9lPkih6PRAarCcLosVSEO+kWyfqfVO/5A4JB4CsehZANiAATnaN1kmavs
+296AwJI/DMmNlnQkRtwaqTfSGq0S5B4Mb1dPYJPJsRfvZ4+/I/aUjvb6Eogpown5
+1Ry/tJ0VdpfaGdsKAQAy70U8c8PscYV3TRRSeaNfZhWL1AKjni6qh1U=
+-----END PRIVATE KEY-----

spire/config/envoy-downstream.yaml

@@ -0,0 +1,101 @@
+# Envoy SDS downstream configuration — mTLS client side.
+#
+# Envoy fetches its X.509-SVID and trust bundle from the SPIRE agent via SDS.
+# No static certificate files are used — this is the core of PKI-10.
+#
+# Identity: spiffe://cosmian-test-a.local/envoy-downstream
+# Ports:
+#   :8001 — plaintext ingress (probe input from socat-probe)
+#   :9902 — admin interface (health / stats)
+
+node:
+  id: "envoy-downstream"
+  cluster: "spire-sds-test"
+
+admin:
+  address:
+    socket_address:
+      address: 0.0.0.0
+      port_value: 9902
+
+static_resources:
+  clusters:
+  # ── Upstream cluster: envoy-upstream via mTLS ─────────────────────────────
+  - name: upstream_mtls
+    connect_timeout: 2s
+    type: STRICT_DNS
+    load_assignment:
+      cluster_name: upstream_mtls
+      endpoints:
+      - lb_endpoints:
+        - endpoint:
+            address:
+              socket_address:
+                address: envoy-sds-upstream
+                port_value: 8001
+    transport_socket:
+      name: envoy.transport_sockets.tls
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        common_tls_context:
+          # Client cert: X.509-SVID from SPIRE via SDS — no static cert file
+          tls_certificate_sds_secret_configs:
+          - name: "spiffe://cosmian-test-a.local/envoy-downstream"
+            sds_config:
+              resource_api_version: V3
+              api_config_source:
+                api_type: GRPC
+                transport_api_version: V3
+                grpc_services:
+                - envoy_grpc:
+                    cluster_name: spire_agent
+          # CA bundle: trust bundle from SPIRE via SDS — no static CA file
+          combined_validation_context:
+            default_validation_context:
+              match_typed_subject_alt_names:
+              - san_type: URI
+                matcher:
+                  prefix: "spiffe://cosmian-test-a.local/"
+            validation_context_sds_secret_config:
+              name: "spiffe://cosmian-test-a.local"
+              sds_config:
+                resource_api_version: V3
+                api_config_source:
+                  api_type: GRPC
+                  transport_api_version: V3
+                  grpc_services:
+                  - envoy_grpc:
+                      cluster_name: spire_agent
+
+  # ── SPIRE agent SDS cluster (Unix socket) ────────────────────────────────
+  - name: spire_agent
+    connect_timeout: 1s
+    type: STATIC
+    typed_extension_protocol_options:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicit_http_config:
+          http2_protocol_options: {}
+    load_assignment:
+      cluster_name: spire_agent
+      endpoints:
+      - lb_endpoints:
+        - endpoint:
+            address:
+              pipe:
+                path: /tmp/spire-agent/public/api.sock
+
+  listeners:
+  # ── Plaintext ingress: accepts probe traffic, forwards via mTLS ───────────
+  - name: listener_ingress
+    address:
+      socket_address:
+        address: 0.0.0.0
+        port_value: 8001
+    filter_chains:
+    - filters:
+      - name: envoy.filters.network.tcp_proxy
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+          cluster: upstream_mtls
+          stat_prefix: probe_ingress

spire/config/envoy-upstream.yaml

@@ -0,0 +1,104 @@
+# Envoy SDS upstream configuration — mTLS server side.
+#
+# Envoy fetches its X.509-SVID and trust bundle from the SPIRE agent via
+# SDS (Secret Discovery Service) over the Workload API Unix socket.
+# No static certificate files are used — this is the core of PKI-10.
+#
+# Identity: spiffe://cosmian-test-a.local/envoy-upstream
+# Ports:
+#   :8001 — mTLS listener (receives connections from envoy-downstream)
+#   :9901 — admin interface (health / stats)
+
+node:
+  id: "envoy-upstream"
+  cluster: "spire-sds-test"
+
+admin:
+  address:
+    socket_address:
+      address: 0.0.0.0
+      port_value: 9901
+
+static_resources:
+  clusters:
+  # ── Backend: echo service (socat-echo container) ─────────────────────────
+  - name: echo_backend
+    connect_timeout: 1s
+    type: STRICT_DNS
+    load_assignment:
+      cluster_name: echo_backend
+      endpoints:
+      - lb_endpoints:
+        - endpoint:
+            address:
+              socket_address:
+                address: socat-echo
+                port_value: 8000
+
+  # ── SPIRE agent SDS cluster (Unix socket) ────────────────────────────────
+  # Envoy connects to the SPIRE Workload API / SDS gRPC endpoint.
+  - name: spire_agent
+    connect_timeout: 1s
+    type: STATIC
+    typed_extension_protocol_options:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicit_http_config:
+          http2_protocol_options: {}
+    load_assignment:
+      cluster_name: spire_agent
+      endpoints:
+      - lb_endpoints:
+        - endpoint:
+            address:
+              pipe:
+                path: /tmp/spire-agent/public/api.sock
+
+  listeners:
+  # ── mTLS listener: certificates delivered by SPIRE SDS (no cert files) ───
+  - name: listener_mtls
+    address:
+      socket_address:
+        address: 0.0.0.0
+        port_value: 8001
+    filter_chains:
+    - filters:
+      - name: envoy.filters.network.tcp_proxy
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+          cluster: echo_backend
+          stat_prefix: mtls_ingress
+      transport_socket:
+        name: envoy.transport_sockets.tls
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+          require_client_certificate: true
+          common_tls_context:
+            # Server cert: X.509-SVID from SPIRE via SDS — no static cert file
+            tls_certificate_sds_secret_configs:
+            - name: "spiffe://cosmian-test-a.local/envoy-upstream"
+              sds_config:
+                resource_api_version: V3
+                api_config_source:
+                  api_type: GRPC
+                  transport_api_version: V3
+                  grpc_services:
+                  - envoy_grpc:
+                      cluster_name: spire_agent
+            # CA bundle: trust bundle from SPIRE via SDS — no static CA file
+            combined_validation_context:
+              default_validation_context:
+                match_typed_subject_alt_names:
+                - san_type: URI
+                  matcher:
+                    prefix: "spiffe://cosmian-test-a.local/"
+              validation_context_sds_secret_config:
+                name: "spiffe://cosmian-test-a.local"
+                sds_config:
+                  resource_api_version: V3
+                  api_config_source:
+                    api_type: GRPC
+                    transport_api_version: V3
+                    grpc_services:
+                    - envoy_grpc:
+                        cluster_name: spire_agent