Currently the SPIRE server has a command to validate the configuration file. This request would extend the validation to have per-plugin validation be part of the process, using the newly added "Validate" RPC provided by the spire-plugin-sdk "config" service.

Upon running the command, the logic would launch (in a non-conflicting manner) an instance of each plugin referenced in the configuration and pass the configuration to the plugin's Validate func.

After the core configuration an all plugins report valid / invalid status, the results would be combined for feedback to the administrator that validated the configuration.

Validation is limited to ensuring that the correct fields are present, they have values of the correct types, and where they must agree with each other internally, they agree.

Validation doesn't extend to anything that requires the additional reads of config files not related to SPIRE, opening sockets, or communicating to other systems.