Extract the service name from a SPIFFE path

[mattbates]

A SPIFFE ID has a path that can be used to encode keys and values - eg a namespace (ns) and service account (sa):

spiffe://trust.domain/ns/foo/sa/bar

This update finds the service name using the service account sa component of the path in the ID. This was required in order to use tconfigd in an environment with SPIRE on Kubenetes, using the standard SPIFFE ID format.

The alternative to this would be to keep the existing implementation and update the service name to include the full path. This is currently hardcoded (https://github.com/tokenetes/tconfigd/blob/main/service/common/common.go#L4) so we'd need a way to configure this.

[kchiranjewee63]

@mattbates thanks for the contribution! We actually already have the tokenetes SPIFFE ID as a configuration (tokenetesSpiffeId), it was just missed to be used.

Instead of parsing the path, we should compare the client's SPIFFE ID with the configured tokenetes SPIFFE ID. If they match, use the TOKENETES_SERVICE_NAME constant, otherwise extract the service name from the path as you've done.

[kchiranjewee63]

Suggested change

	pathParts := strings.Split(spiffeID.Path(), "/")
	serviceName := pathParts[len(pathParts)-1]
	var serviceName string
	if spiffeID.String() == wss.TokenetesSpiffeId.String() {
	serviceName = common.TOKENETES_SERVICE_NAME
	} else {
	serviceName = extractServiceNameFromSPIFFEPath(spiffeID.Path())
	}

And the function extractServiceNameFromSPIFFEPath can be:

  // extractServiceNameFromSPIFFEPath extracts the service name from a SPIFFE ID path.
  // For Kubernetes SPIFFE IDs, it looks for /sa/ pattern and extracts the service account name.
  // Falls back to the last path component if /sa/ pattern is not found.
  func extractServiceNameFromSPIFFEPath(path string) string {
      if saIndex := strings.Index(path, "/sa/"); saIndex != -1 {
          // Found /sa/ pattern, extract the service account name
          saStart := saIndex + 4 // skip "/sa/"
          pathAfterSA := path[saStart:]
          if nextSlash := strings.Index(pathAfterSA, "/"); nextSlash != -1 {
              return pathAfterSA[:nextSlash]
          }

          return pathAfterSA
      }

      // Fallback to last path component
      pathParts := strings.Split(path, "/")

      return pathParts[len(pathParts)-1]
  }