Add SPIFFE based registration driver for OCM cluster and add-on registration

[mikeshng]

Describe the enhancement

SPIFFE is an universal identity control plane for distributed systems. It's widely adopted as a standardized workload identity specification.

OCM currently supports two types of cluster/add-on registration via registration drivers: CSR/Certificate and AWS IRSA (work in progress).

This enhancement request is to add a new SPIFFE based registration driver to OCM, enabling clusters and add-ons to register using SPIFFE identities.

A potential use case is enabling OCM Argo CD Agent add-on users to leverage SPIFFE based authentication for the communication between Argo CD Agent principal and agent components.

[mikeshng]

CC @qiujian16 @zhujian7 @jannfis

[ramekris3163]

@mikeshng i'm interested in contributing to this feature. Do we have a design/enhancement proposal already for this or do we have to create one?

[mikeshng]

@ramekris3163 thank you for help!

@zhujian7 any docs or pocs you can share when you explored the SPIFFE topic?

[zhujian7]

I am investigating accessing managed clusters from hub without managed cluster's serviceaccount secret using SPIFFE. However, this issue looks like a different direction, I do not have a design/enhancement proposal for now.