Default package

Get desktop application:
View/edit binary Protocol Buffers messages

/////////////////////////////////////////////////////////////////////// X509-SVID Profile ///////////////////////////////////////////////////////////////////////

• rpc FetchX509SVID (X509SVIDRequest, stream X509SVIDResponse)

  workload.proto:14

  Fetch X.509-SVIDs for all SPIFFE identities the workload is entitled to, as well as related information like trust bundles and CRLs. As this information changes, subsequent messages will be streamed from the server.

  message X509SVIDRequest

  workload.proto:43

  The X509SVIDRequest message conveys parameters for requesting an X.509-SVID. There are currently no request parameters.

  (message has no fields)

  message X509SVIDResponse

  workload.proto:48

  The X509SVIDResponse message carries X.509-SVIDs and related information, including a set of global CRLs and a list of bundles the workload may use for federating with foreign trust domains.

  • repeated X509SVID svids = 1

    Required. A list of X509SVID messages, each of which includes a single X.509-SVID, its private key, and the bundle for the trust domain.

  • repeated bytes crl = 2

    Optional. ASN.1 DER encoded certificate revocation lists.

  • map<string, bytes> federated_bundles = 3

    Optional. CA certificate bundles belonging to foreign trust domains that the workload should trust, keyed by the SPIFFE ID of the foreign trust domain. Bundles are ASN.1 DER encoded.

• rpc FetchX509Bundles (X509BundlesRequest, stream X509BundlesResponse)

  workload.proto:20

  Fetch trust bundles and CRLs. Useful for clients that only need to validate SVIDs without obtaining an SVID for themself. As this information changes, subsequent messages will be streamed from the server.

  message X509BundlesRequest

  workload.proto:87

  The X509BundlesRequest message conveys parameters for requesting X.509 bundles. There are currently no such parameters.

  (message has no fields)

  message X509BundlesResponse

  workload.proto:92

  The X509BundlesResponse message carries a set of global CRLs and a map of trust bundles the workload should trust.

  • repeated bytes crl = 1

    Optional. ASN.1 DER encoded certificate revocation lists.

  • map<string, bytes> bundles = 2

    Required. CA certificate bundles belonging to trust domains that the workload should trust, keyed by the SPIFFE ID of the trust domain. Bundles are ASN.1 DER encoded.

• rpc FetchJWTSVID (JWTSVIDRequest, JWTSVIDResponse)

  workload.proto:29

  Fetch JWT-SVIDs for all SPIFFE identities the workload is entitled to, for the requested audience. If an optional SPIFFE ID is requested, only the JWT-SVID for that SPIFFE ID is returned.

  message JWTSVIDRequest

  workload.proto:102

  • repeated string audience = 1

    Required. The audience(s) the workload intends to authenticate against.

  • string spiffe_id = 2

    Optional. The requested SPIFFE ID for the JWT-SVID. If unset, all JWT-SVIDs to which the workload is entitled are requested.

  message JWTSVIDResponse

  workload.proto:112

  The JWTSVIDResponse message conveys JWT-SVIDs.

  • repeated JWTSVID svids = 1

    Required. The list of returned JWT-SVIDs.

• rpc FetchJWTBundles (JWTBundlesRequest, stream JWTBundlesResponse)

  workload.proto:34

  Fetches the JWT bundles, formatted as JWKS documents, keyed by the SPIFFE ID of the trust domain. As this information changes, subsequent messages will be streamed from the server.

  message JWTBundlesRequest

  workload.proto:134

  The JWTBundlesRequest message conveys parameters for requesting JWT bundles. There are currently no such parameters.

  (message has no fields)

  message JWTBundlesResponse

  workload.proto:137

  The JWTBundlesReponse conveys JWT bundles.

  • map<string, bytes> bundles = 1

    Required. JWK encoded JWT bundles, keyed by the SPIFFE ID of the trust domain.

• rpc ValidateJWTSVID (ValidateJWTSVIDRequest, ValidateJWTSVIDResponse)

  workload.proto:38

  Validates a JWT-SVID against the requested audience. Returns the SPIFFE ID of the JWT-SVID and JWT claims.

  message ValidateJWTSVIDRequest

  workload.proto:145

  The ValidateJWTSVIDRequest message conveys request parameters for JWT-SVID validation.

  • string audience = 1

    Required. The audience of the validating party. The JWT-SVID must contain an audience claim which contains this value in order to succesfully validate.

  • string svid = 2

    Required. The JWT-SVID to validate, encoded using JWS Compact Serialization.

  message ValidateJWTSVIDResponse

  workload.proto:157

  The ValidateJWTSVIDReponse message conveys the JWT-SVID validation results.

  • string spiffe_id = 1

    Required. The SPIFFE ID of the validated JWT-SVID.

  • optional google.protobuf.Struct claims = 2

    Optional. Arbitrary claims contained within the payload of the validated JWT-SVID.

The JWTSVID message carries the JWT-SVID token and associated metadata.

Used in: JWTSVIDResponse

• string spiffe_id = 1

  Required. The SPIFFE ID of the JWT-SVID.

• string svid = 2

  Required. Encoded JWT using JWS Compact Serialization.

• string hint = 3

  Optional. An operator-specified string used to provide guidance on how this identity should be used by a workload when more than one SVID is returned. For example, `internal` and `external` to indicate an SVID for internal or external use, respectively.

The X509SVID message carries a single SVID and all associated information, including the X.509 bundle for the trust domain.

Used in: X509SVIDResponse

• string spiffe_id = 1

  Required. The SPIFFE ID of the SVID in this entry

• bytes x509_svid = 2

  Required. ASN.1 DER encoded certificate chain. MAY include intermediates, the leaf certificate (or SVID itself) MUST come first.

• bytes x509_svid_key = 3

  Required. ASN.1 DER encoded PKCS#8 private key. MUST be unencrypted.

• bytes bundle = 4

  Required. ASN.1 DER encoded X.509 bundle for the trust domain.

• string hint = 5

  Optional. An operator-specified string used to provide guidance on how this identity should be used by a workload when more than one SVID is returned. For example, `internal` and `external` to indicate an SVID for internal or external use, respectively.