feat(spiffe): SPIFFE Agent sidecar + rep socket wiring (RFC UAA-SPIFFE-001)

jobs/rep/spec

@@ -221,6 +221,9 @@ properties:
   diego.executor.instance_identity_validity_period_in_hours:
     description: "Validity period for the generated instance identity certificate"
     default: 24
+  diego.executor.spiffe_socket_dir:
+    description: "Host directory of the SPIFFE workload socket to bind-mount read-only into app containers (must equal spiffe-agent host_socket_dir). Empty disables."
+    default: ""
   diego.executor.max_log_lines_per_second:
     description: "EXPERIMENTAL: Maximum log lines allowed per second per app instance. Default value of 0 will disable rate limiting. Minimum recommended value is 100."
     default: 0

jobs/rep/templates/rep.json.erb

@@ -218,6 +218,10 @@
     end
   end
 
+  if_p("diego.executor.spiffe_socket_dir") do |spiffe_dir|
+    config[:spiffe_socket_dir] = spiffe_dir unless spiffe_dir.to_s.empty?
+  end
+
   config[:time_format] = "rfc3339"
 
   if_p("containers.layering_mode") do |mode|

jobs/rep/templates/setup_mounted_data_dirs.erb

@@ -95,3 +95,19 @@ proxy_config_dir=${garden_shared_dir}/proxy_config
 rm -rf "$proxy_config_dir"
 mkdir -p "$proxy_config_dir"
 chown -R vcap:vcap "$proxy_config_dir"
+
+# SPIFFE workload socket directory (shared with the spiffe-agent job). The
+# executor bind-mounts this host directory read-only into every app container so
+# workloads can reach the spiffe-agent's Workload API socket. App containers run
+# as an unprivileged, user-namespaced uid that is neither the directory owner nor
+# in its group, so the directory must be world-traversable (o+x) for a workload
+# to reach the 0666 socket inside it. 0711 withholds read (o-r): containers can
+# connect to the known socket path but cannot enumerate the directory.
+<% if_p("diego.executor.spiffe_socket_dir") do |spiffe_socket_dir| %>
+<% unless spiffe_socket_dir.to_s.empty? %>
+spiffe_socket_dir="<%= spiffe_socket_dir %>"
+mkdir -p "$spiffe_socket_dir"
+chown vcap:vcap "$spiffe_socket_dir"
+chmod 0711 "$spiffe_socket_dir"
+<% end %>
+<% end %>

jobs/spiffe-agent/monit

@@ -0,0 +1,5 @@
+check process spiffe-agent
+  with pidfile /var/vcap/sys/run/bpm/spiffe-agent/spiffe-agent.pid
+  start program "/var/vcap/jobs/bpm/bin/bpm start spiffe-agent"
+  stop program "/var/vcap/jobs/bpm/bin/bpm stop spiffe-agent"
+  group vcap

jobs/spiffe-agent/spec

@@ -0,0 +1,40 @@
+---
+name: spiffe-agent
+
+templates:
+  spiffe-agent.json.erb: config/spiffe-agent.json
+  bpm.yml.erb: config/bpm.yml
+  signer_ca.crt.erb: config/certs/signer/ca.crt
+  bbs_ca.crt.erb: config/certs/bbs/ca.crt
+  bbs_client.crt.erb: config/certs/bbs/client.crt
+  bbs_client.key.erb: config/certs/bbs/client.key
+
+packages:
+  - spiffe-agent
+
+properties:
+  spiffe_agent.trust_domain:
+    description: "REQUIRED: SPIFFE trust domain for issued identities (e.g. cf.internal)."
+  spiffe_agent.signer_url:
+    description: "REQUIRED: Base URL of the UAA SPIFFE signer endpoint."
+  spiffe_agent.signer_client_id:
+    description: "OAuth client id used to authenticate to the signer."
+  spiffe_agent.signer_client_secret:
+    description: "OAuth client secret used to authenticate to the signer."
+  spiffe_agent.signer_ca_cert:
+    description: "PEM-encoded CA certificate used to verify the signer TLS endpoint. If empty, system roots are used."
+  spiffe_agent.bbs.api_location:
+    description: "Address of the BBS server."
+    default: "bbs.service.cf.internal:8889"
+  spiffe_agent.bbs.ca_cert:
+    description: "REQUIRED: PEM-encoded CA certificate for the BBS server."
+  spiffe_agent.bbs.client_cert:
+    description: "REQUIRED: PEM-encoded client certificate for the BBS server."
+  spiffe_agent.bbs.client_key:
+    description: "REQUIRED: PEM-encoded client key for the BBS server."
+  spiffe_agent.host_socket_dir:
+    description: "Directory on the host (shared with workloads) where the workload API socket is created."
+    default: "/var/vcap/data/spiffe-agent/shared"
+  spiffe_agent.log_level:
+    description: "Log level (debug, info, error, fatal)."
+    default: "info"

jobs/spiffe-agent/templates/bbs_ca.crt.erb

@@ -0,0 +1 @@
+<%= p("spiffe_agent.bbs.ca_cert") %>

jobs/spiffe-agent/templates/bbs_client.crt.erb

@@ -0,0 +1 @@
+<%= p("spiffe_agent.bbs.client_cert") %>

jobs/spiffe-agent/templates/bbs_client.key.erb

@@ -0,0 +1 @@
+<%= p("spiffe_agent.bbs.client_key") %>

jobs/spiffe-agent/templates/bpm.yml.erb

@@ -0,0 +1,14 @@
+---
+processes:
+- name: spiffe-agent
+  executable: /var/vcap/packages/spiffe-agent/bin/spiffe-agent
+  args:
+    - -config=/var/vcap/jobs/spiffe-agent/config/spiffe-agent.json
+  limits:
+    open_files: 100000
+  unsafe:
+    privileged: true
+    host_pid_namespace: true
+  additional_volumes:
+  - path: <%= p("spiffe_agent.host_socket_dir") %>
+    writable: true

jobs/spiffe-agent/templates/signer_ca.crt.erb

@@ -0,0 +1 @@
+<%= p("spiffe_agent.signer_ca_cert", "") %>

jobs/spiffe-agent/templates/spiffe-agent.json.erb

@@ -0,0 +1,21 @@
+<%=
+  conf_dir = "/var/vcap/jobs/spiffe-agent/config"
+  host_socket_dir = p("spiffe_agent.host_socket_dir")
+
+  config = {
+    log_level: p("spiffe_agent.log_level"),
+    socket_path: "#{host_socket_dir}/workload.sock",
+    trust_domain: p("spiffe_agent.trust_domain"),
+    cell_id: spec.id,
+    signer_url: p("spiffe_agent.signer_url"),
+    signer_client_id: p("spiffe_agent.signer_client_id"),
+    signer_client_secret: p("spiffe_agent.signer_client_secret"),
+    signer_ca_cert_file: (p("spiffe_agent.signer_ca_cert", "").empty? ? "" : "#{conf_dir}/certs/signer/ca.crt"),
+    bbs_address: "https://#{p("spiffe_agent.bbs.api_location")}",
+    bbs_ca_cert_file: "#{conf_dir}/certs/bbs/ca.crt",
+    bbs_client_cert_file: "#{conf_dir}/certs/bbs/client.crt",
+    bbs_client_key_file: "#{conf_dir}/certs/bbs/client.key",
+  }
+
+  config.to_json
+%>

packages/bbs/spec

@@ -8,4 +8,4 @@ files:
   - code.cloudfoundry.org/go.mod
   - code.cloudfoundry.org/go.sum
   - code.cloudfoundry.org/vendor/modules.txt
-  - code.cloudfoundry.org/vendor/code.cloudfoundry.org/bbs/cmd/bbs/*.go # gosub
+  - code.cloudfoundry.org/vendor/**/*

packages/locket/spec

@@ -8,4 +8,4 @@ files:
   - code.cloudfoundry.org/go.mod
   - code.cloudfoundry.org/go.sum
   - code.cloudfoundry.org/vendor/modules.txt
-  - code.cloudfoundry.org/vendor/code.cloudfoundry.org/locket/cmd/locket/*.go # gosub
+  - code.cloudfoundry.org/vendor/**/*

packages/spiffe-agent/packaging

@@ -0,0 +1,15 @@
+set -e
+
+# create GOPATH
+mkdir -p ${BOSH_INSTALL_TARGET}/src
+mv * ${BOSH_INSTALL_TARGET}/src
+mv ${BOSH_INSTALL_TARGET}/src .
+
+source /var/vcap/packages/golang-*-linux/bosh/compile.env
+
+mkdir ${BOSH_INSTALL_TARGET}/bin
+export GOBIN=${BOSH_INSTALL_TARGET}/bin
+
+pushd src/code.cloudfoundry.org
+go install code.cloudfoundry.org/spiffe-agent/cmd/spiffe-agent
+popd

packages/spiffe-agent/spec

@@ -0,0 +1,153 @@
+---
+name: spiffe-agent
+
+dependencies:
+  - golang-1.26-linux
+
+files:
+  - code.cloudfoundry.org/go.mod
+  - code.cloudfoundry.org/go.sum
+  - code.cloudfoundry.org/vendor/modules.txt
+  - code.cloudfoundry.org/spiffe-agent/bbsresolver/*.go # gosub
+  - code.cloudfoundry.org/spiffe-agent/cfattestor/*.go # gosub
+  - code.cloudfoundry.org/spiffe-agent/cmd/spiffe-agent/*.go # gosub
+  - code.cloudfoundry.org/spiffe-agent/config/*.go # gosub
+  - code.cloudfoundry.org/spiffe-agent/signer/*.go # gosub
+  - code.cloudfoundry.org/spiffe-agent/workloadapi/*.go # gosub
+  - code.cloudfoundry.org/vendor/code.cloudfoundry.org/bbs/*.go # gosub
+  - code.cloudfoundry.org/vendor/code.cloudfoundry.org/bbs/encryption/*.go # gosub
+  - code.cloudfoundry.org/vendor/code.cloudfoundry.org/bbs/events/*.go # gosub
+  - code.cloudfoundry.org/vendor/code.cloudfoundry.org/bbs/format/*.go # gosub
+  - code.cloudfoundry.org/vendor/code.cloudfoundry.org/bbs/models/*.go # gosub
+  - code.cloudfoundry.org/vendor/code.cloudfoundry.org/bbs/trace/*.go # gosub
+  - code.cloudfoundry.org/vendor/code.cloudfoundry.org/cfhttp/v2/*.go # gosub
+  - code.cloudfoundry.org/vendor/code.cloudfoundry.org/lager/v3/*.go # gosub
+  - code.cloudfoundry.org/vendor/code.cloudfoundry.org/lager/v3/internal/truncate/*.go # gosub
+  - code.cloudfoundry.org/vendor/code.cloudfoundry.org/lager/v3/lagerflags/*.go # gosub
+  - code.cloudfoundry.org/vendor/code.cloudfoundry.org/tlsconfig/*.go # gosub
+  - code.cloudfoundry.org/vendor/github.com/bmizerany/pat/*.go # gosub
+  - code.cloudfoundry.org/vendor/github.com/gogo/protobuf/gogoproto/*.go # gosub
+  - code.cloudfoundry.org/vendor/github.com/gogo/protobuf/proto/*.go # gosub
+  - code.cloudfoundry.org/vendor/github.com/gogo/protobuf/protoc-gen-gogo/descriptor/*.go # gosub
+  - code.cloudfoundry.org/vendor/github.com/gogo/protobuf/sortkeys/*.go # gosub
+  - code.cloudfoundry.org/vendor/github.com/openzipkin/zipkin-go/idgenerator/*.go # gosub
+  - code.cloudfoundry.org/vendor/github.com/openzipkin/zipkin-go/model/*.go # gosub
+  - code.cloudfoundry.org/vendor/github.com/spiffe/go-spiffe/v2/proto/spiffe/workload/*.go # gosub
+  - code.cloudfoundry.org/vendor/github.com/tedsuo/ifrit/*.go # gosub
+  - code.cloudfoundry.org/vendor/github.com/tedsuo/ifrit/grouper/*.go # gosub
+  - code.cloudfoundry.org/vendor/github.com/tedsuo/ifrit/sigmon/*.go # gosub
+  - code.cloudfoundry.org/vendor/github.com/tedsuo/rata/*.go # gosub
+  - code.cloudfoundry.org/vendor/github.com/vito/go-sse/sse/*.go # gosub
+  - code.cloudfoundry.org/vendor/golang.org/x/net/http/httpguts/*.go # gosub
+  - code.cloudfoundry.org/vendor/golang.org/x/net/http2/*.go # gosub
+  - code.cloudfoundry.org/vendor/golang.org/x/net/http2/hpack/*.go # gosub
+  - code.cloudfoundry.org/vendor/golang.org/x/net/idna/*.go # gosub
+  - code.cloudfoundry.org/vendor/golang.org/x/net/internal/httpcommon/*.go # gosub
+  - code.cloudfoundry.org/vendor/golang.org/x/net/internal/httpsfv/*.go # gosub
+  - code.cloudfoundry.org/vendor/golang.org/x/net/internal/timeseries/*.go # gosub
+  - code.cloudfoundry.org/vendor/golang.org/x/net/trace/*.go # gosub
+  - code.cloudfoundry.org/vendor/golang.org/x/sys/unix/*.go # gosub
+  - code.cloudfoundry.org/vendor/golang.org/x/sys/unix/*.s # gosub
+  - code.cloudfoundry.org/vendor/golang.org/x/text/secure/bidirule/*.go # gosub
+  - code.cloudfoundry.org/vendor/golang.org/x/text/transform/*.go # gosub
+  - code.cloudfoundry.org/vendor/golang.org/x/text/unicode/bidi/*.go # gosub
+  - code.cloudfoundry.org/vendor/golang.org/x/text/unicode/norm/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/genproto/googleapis/rpc/status/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/attributes/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/backoff/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/balancer/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/balancer/base/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/balancer/endpointsharding/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/balancer/grpclb/state/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/balancer/pickfirst/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/balancer/pickfirst/internal/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/balancer/roundrobin/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/channelz/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/codes/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/connectivity/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/credentials/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/credentials/insecure/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/encoding/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/encoding/internal/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/encoding/proto/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/experimental/stats/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/grpclog/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/grpclog/internal/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/backoff/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/balancer/weight/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/balancerload/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/binarylog/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/buffer/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/channelz/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/credentials/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/envconfig/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/grpclog/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/grpcsync/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/grpcutil/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/idle/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/mem/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/metadata/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/pretty/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/proxyattributes/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/resolver/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/resolver/delegatingresolver/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/resolver/dns/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/resolver/dns/internal/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/resolver/passthrough/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/resolver/unix/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/serviceconfig/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/stats/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/status/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/syscall/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/transport/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/transport/networktype/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/internal/transport/readyreader/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/keepalive/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/mem/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/metadata/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/peer/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/resolver/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/resolver/dns/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/serviceconfig/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/stats/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/status/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/grpc/tap/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/encoding/protojson/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/encoding/prototext/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/encoding/protowire/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/descfmt/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/descopts/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/detrand/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/editiondefaults/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/editiondefaults/editions_defaults.binpb
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/encoding/defval/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/encoding/json/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/encoding/messageset/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/encoding/tag/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/encoding/text/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/errors/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/filedesc/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/filetype/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/flags/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/genid/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/impl/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/order/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/pragma/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/protolazy/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/set/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/strs/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/internal/version/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/proto/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/protoadapt/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/reflect/protoreflect/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/reflect/protoregistry/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/runtime/protoiface/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/runtime/protoimpl/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/types/known/anypb/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/types/known/durationpb/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/types/known/structpb/*.go # gosub
+  - code.cloudfoundry.org/vendor/google.golang.org/protobuf/types/known/timestamppb/*.go # gosub

src/code.cloudfoundry.org/go.mod

@@ -15,6 +15,7 @@ require (
 	code.cloudfoundry.org/bbs/encryption v1.7.0
 	code.cloudfoundry.org/bbs/format v1.7.0
 	code.cloudfoundry.org/bbs/models v1.6.0
+	code.cloudfoundry.org/buildpackapplifecycle v0.0.0-20260504201830-3e265382f635
 	code.cloudfoundry.org/bytefmt v0.78.0
 	code.cloudfoundry.org/cacheddownloader v0.0.0-20250312193827-23c030d5e4f3
 	code.cloudfoundry.org/certsplitter v0.77.0
@@ -34,6 +35,7 @@ require (
 	code.cloudfoundry.org/localip v0.77.0
 	code.cloudfoundry.org/locket v1.3.0
 	code.cloudfoundry.org/routing-api v0.2.0
+	code.cloudfoundry.org/routing-info v0.1.0
 	code.cloudfoundry.org/tlsconfig v0.60.0
 	github.com/GaryBoone/GoStats v0.0.0-20130122001700-1993eafbef57
 	github.com/ajstarks/svgo v0.0.0-20211024235047-1546f124cd8b
@@ -70,6 +72,7 @@ require (
 	github.com/pborman/getopt v1.1.0
 	github.com/pkg/sftp v1.13.10
 	github.com/spf13/cobra v1.10.2
+	github.com/spiffe/go-spiffe/v2 v2.8.1
 	github.com/square/certstrap v1.3.0
 	github.com/tedsuo/ifrit v0.0.0-20260418191334-846868129986
 	github.com/tedsuo/rata v1.0.0
@@ -81,7 +84,6 @@ require (
 	google.golang.org/grpc v1.81.1
 	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af
 	gopkg.in/yaml.v2 v2.4.0
-	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
@@ -172,4 +174,5 @@ require (
 	golang.org/x/tools v0.46.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260622175928-b703f567277d // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )