Sentry: support delegating certificate signing to an external CA

Ask

Sentry should be able to delegate certificate signing to an external CA, so that no CA signing key needs to exist in the cluster. Comes up with customers under enterprise PKI mandates where certificates may only be issued by their central PKI.

Today

• Sentry signs in-process with an issuer key loaded at startup. Trust bundle stores are the dapr-trust-bundle secret or local files (pkg/sentry/server/ca/).
• The Signer interface is package-internal — no plugin path, no remote signing, no PKCS#11.
• config.Config.CAStore exists but is never read.
• daprd cannot consume an external SPIFFE Workload API.

Upstream

• dapr/dapr#3968 — open since 2021, P1, parked on the temporary-moving-open-from-117 milestone, no implementation activity.
• dapr/dapr#4905 — ACME, closed on the merits in 2022; consensus was SPIFFE plus a pluggable signer.
• Blocker named there: Sentry's certificate storage assumes it owns the signing key.

Decision needed

1. Back on the roadmap, or close dapr/dapr#3968?
2. External issuer (Sentry's intermediate is obtained from outside) or external signer (every workload CSR delegated)? Very different pieces of work, and only the second removes the key from the cluster.
3. Workload certs default to a 24h TTL, so delegated signing means the external PKI issuing a certificate per sidecar per day, and becoming a hard dependency for every sidecar start. Acceptable, or a no on architecture?