Support SPIFFE mTLS in GKS, add blobstore driver for spanner/GCS, etc.

[srago]

• Added SPIFFE mTLS using GKS workload identity, and handle certificate rotation
  • A custom SPIFFE bundle source removes the need for federation as all certs are signed by a trusted GCP authority
• New blobstore driver using spanner and GCS
• New tri-mirror blobstore driver using consensus to allow continued operation if a single mirror is down (still needs GetFromComposite support)
• Action cache partition enforcement to
  • allow dev workflows to read production action cache entries
  • prevent dev workflows from writing to production action cache
• Disk space monitoring

[EdSchouten]

Hey Steve,

Thanks for taking the time to create this PR. Unfortunately, this PR is far too big for me to review and land at once. What doesn't help is that the second half of this PR contains changes on top of changes.

Could you please create PRs for individual pieces of work? Also consider using git rebase -i to reorganise and squash certain commits together. Thanks.

[srago]

Hi Ed,

Will do. I told you it was big. I kept the history in case you thought it added some insight, but I’ll split it up into separate PRs by functionality.

Thanks, Steve

From: Ed Schouten @.> Sent: Friday, March 8, 2024 10:46 PM To: buildbarn/bb-storage @.> Cc: Rago, Steve A [Engineering] @.>; Author @.> Subject: Re: [buildbarn/bb-storage] Support SPIFFE mTLS in GKS, add blobstore driver for spanner/GCS, etc. (PR #193)

Hey Steve,

Thanks for taking the time to create this PR. Unfortunately, this PR is far too big for me to review and land at once. What doesn't help is that the second half of this PR contains changes on top of changes.

Could you please create PRs for individual pieces of work? Also consider using git rebase -i to reorganise and squash certain commits together. Thanks.

— Reply to this email directly, view it on GitHubhttps://urldefense.com/v3/__https:/github.com/buildbarn/bb-storage/pull/193*issuecomment-1986716066__;Iw!!O2kDR7mm-zSJ!pM2QKmAi6_KPUrB5RqzXHjGtBJEbbjvv08PXMH6vnQd2naKsg60DdmqWNiiWaoebwDI0OcMnvd8r9CJQWFnnwc90iifmxg$, or unsubscribehttps://urldefense.com/v3/__https:/github.com/notifications/unsubscribe-auth/ASXI24GRX7UDP5FZS573MU3YXKAWVAVCNFSM6AAAAABENRQZTKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSOBWG4YTMMBWGY__;!!O2kDR7mm-zSJ!pM2QKmAi6_KPUrB5RqzXHjGtBJEbbjvv08PXMH6vnQd2naKsg60DdmqWNiiWaoebwDI0OcMnvd8r9CJQWFnnwc-2Ti4o6A$. You are receiving this because you authored the thread.Message ID: @.**@.>>

---

Your Personal Data: We may collect and process information about you that may be subject to data protection laws. For more information about how we use and disclose your personal data, how we protect your information, our legal basis to use your information, your rights and who you can contact, please refer to: www.gs.com/privacy-noticeshttp://www.gs.com/privacy-notices