Introduce AttestReference API in workloadattestor

proto/spire/plugin/agent/workloadattestor/v1/workloadattestor.proto

@@ -2,6 +2,8 @@ syntax = "proto3";
 package spire.plugin.agent.workloadattestor.v1;
 option go_package = "github.com/spiffe/spire-plugin-sdk/proto/spire/plugin/agent/workloadattestor/v1";
 
+import "google/protobuf/any.proto";
+
 service WorkloadAttestor {
     // Attests the specified workload process. If the process is not one the
     // attestor is in a position to attest (e.g. k8s attestor attesting a
@@ -10,6 +12,17 @@ service WorkloadAttestor {
     // fails to gather all selectors related to that workload, the call will
     // fail. Otherwise the attestor will return one or more workload selectors.
     rpc Attest(AttestRequest) returns (AttestResponse);
+
+    // Attests a workload identified by an opaque reference (e.g. a process
+    // ID, a Kubernetes object reference, etc.). The reference's type URL is
+    // taken from the SPIFFE Broker API specification's WorkloadReference and
+    // delivered verbatim. Plugins that do not understand the supplied
+    // reference type SHOULD return Unimplemented; the host will fall back to
+    // Attest(pid) when the reference is a WorkloadPIDReference. Likewise,
+    // plugins that have not yet implemented this RPC will return Unimplemented
+    // automatically (via UnimplementedWorkloadAttestorServer or unknown-method
+    // dispatch in older binaries), allowing the host to fall back to Attest.
+    rpc AttestReference(AttestReferenceRequest) returns (AttestReferenceResponse);
 }
 
 message AttestRequest {
@@ -22,3 +35,17 @@ message AttestResponse {
     // of the selector is inferred from the plugin name.
     repeated string selector_values = 1;
 }
+
+message AttestReferenceRequest {
+    // Required. Reference to the workload to be attested. The packed message
+    // is one of the WorkloadReference reference types defined by the SPIFFE
+    // Broker API specification (e.g. WorkloadPIDReference,
+    // KubernetesObjectReference) or a vendor-specific extension type.
+    google.protobuf.Any reference = 1;
+}
+
+message AttestReferenceResponse {
+    // Optional. Selector values related to the attested workload. The type
+    // of the selector is inferred from the plugin name.
+    repeated string selector_values = 1;
+}