Spire Agent doesn't support cgroupsv2 for docker workload attestor plugin #5
Description
Client's attestation isn't a security concern but more of a practical concern since a client cannot retrieve anything from the vault (write only policies).
Still, attesting clients' workloads makes harder for a user to spoof it's client identity. In order to do that, we currently leverage spire docker plugin, which provides a good way of making sure that the workload running runs inside of one of the HPCS-provided images.
This docker plugin makes usage of cgroupsv1 /proc/PID/cgroups which provides informations about the container, etc.
This behaviour has been modified in cgroupsv2 and this file doesn't provide anymore the needed informations. This way, docker plugin's functions are broken.
see : spiffe/spire#4682
and : spiffe/spire#4251