pub struct SpiffeClient { /* private fields */ }Expand description
The SPIFFE Workload API client: connects to the SPIRE agent over a Unix socket, fetches X.509 SVIDs for the workload, and refreshes them before expiry.
The client holds a WorkloadApiTransport (the production gRPC
transport or a test fake) and delegates the actual fetch to it.
The refresh logic (when to refresh, what to do on failure) lives
here; the transport is the seam for the wire protocol.
Implementations§
Source§impl SpiffeClient
impl SpiffeClient
Sourcepub fn new(
config: SpiffeConfig,
transport: Arc<dyn WorkloadApiTransport>,
) -> Self
pub fn new( config: SpiffeConfig, transport: Arc<dyn WorkloadApiTransport>, ) -> Self
Build a client from the resolved SPIFFE config and a transport.
The transport is the seam for the Workload API wire protocol:
the production gRPC transport (GrpcWorkloadApi) or a test
fake (FakeWorkloadApi).
Sourcepub fn config(&self) -> &SpiffeConfig
pub fn config(&self) -> &SpiffeConfig
The resolved SPIFFE configuration.
Sourcepub fn workload_identity(&self, path: &str) -> SpiffeIdentity
pub fn workload_identity(&self, path: &str) -> SpiffeIdentity
The workload’s SPIFFE ID for the configured trust domain and a path. This is the identity the SVID’s URI SAN carries and the auth identity the mesh uses for policy decisions.
Sourcepub async fn fetch_svid(&self) -> Result<Vec<SpiffeSvid>, SpiffeError>
pub async fn fetch_svid(&self) -> Result<Vec<SpiffeSvid>, SpiffeError>
Fetch the workload’s current X.509 SVIDs from the Workload API.
The response contains one SVID per SPIFFE ID the workload is
authorized to present (typically one). The first SVID is the
primary; callers that only need one SVID can use
Self::fetch_primary_svid.
Sourcepub async fn fetch_primary_svid(&self) -> Result<SpiffeSvid, SpiffeError>
pub async fn fetch_primary_svid(&self) -> Result<SpiffeSvid, SpiffeError>
Fetch the workload’s primary (first) X.509 SVID from the
Workload API. Convenience wrapper around Self::fetch_svid
that returns the first SVID or an error when the response is
empty.
Sourcepub async fn fetch_trust_bundle(&self) -> Result<SpiffeTrustBundle, SpiffeError>
pub async fn fetch_trust_bundle(&self) -> Result<SpiffeTrustBundle, SpiffeError>
Fetch the trust bundle (the SPIRE signing CAs) from the Workload API. Used as the peer-verification root store in the mTLS TLS config.
Sourcepub fn refresh_result_from_fetch(
&self,
fetch_result: &Result<SpiffeSvid, SpiffeError>,
) -> SvidRefreshResult
pub fn refresh_result_from_fetch( &self, fetch_result: &Result<SpiffeSvid, SpiffeError>, ) -> SvidRefreshResult
Refresh the SVID before expiry. The client refreshes at half the
remaining lifetime by default; the configured
svid_refresh_interval is the upper bound on the cadence.
This is the synchronous wrapper used by the refresh loop’s metric recording path. The actual fetch is async (delegated to the transport); the refresh loop spawns the async fetch and records the result here.
Trait Implementations§
Source§impl Clone for SpiffeClient
impl Clone for SpiffeClient
Source§fn clone(&self) -> SpiffeClient
fn clone(&self) -> SpiffeClient
1.0.0 · Source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source. Read moreAuto Trait Implementations§
impl Freeze for SpiffeClient
impl !RefUnwindSafe for SpiffeClient
impl Send for SpiffeClient
impl Sync for SpiffeClient
impl Unpin for SpiffeClient
impl !UnwindSafe for SpiffeClient
Blanket Implementations§
§impl<T> AnyExt for T
impl<T> AnyExt for T
§fn downcast_ref<T>(this: &Self) -> Option<&T>where
T: Any,
fn downcast_ref<T>(this: &Self) -> Option<&T>where
T: Any,
T behind reference§fn downcast_mut<T>(this: &mut Self) -> Option<&mut T>where
T: Any,
fn downcast_mut<T>(this: &mut Self) -> Option<&mut T>where
T: Any,
T behind mutable reference§fn downcast_rc<T>(this: Rc<Self>) -> Result<Rc<T>, Rc<Self>>where
T: Any,
fn downcast_rc<T>(this: Rc<Self>) -> Result<Rc<T>, Rc<Self>>where
T: Any,
T behind Rc pointer§fn downcast_arc<T>(this: Arc<Self>) -> Result<Arc<T>, Arc<Self>>where
T: Any,
fn downcast_arc<T>(this: Arc<Self>) -> Result<Arc<T>, Arc<Self>>where
T: Any,
T behind Arc pointer§fn downcast_box<T>(this: Box<Self>) -> Result<Box<T>, Box<Self>>where
T: Any,
fn downcast_box<T>(this: Box<Self>) -> Result<Box<T>, Box<Self>>where
T: Any,
T behind Box pointer§fn downcast_move<T>(this: Self) -> Option<T>
fn downcast_move<T>(this: Self) -> Option<T>
Self to T,
useful only in generic context as a workaround for specializationSource§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
Source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Source§impl<T> CloneToUninit for Twhere
T: Clone,
impl<T> CloneToUninit for Twhere
T: Clone,
§impl<T, X> CoerceTo<T> for Xwhere
T: CoerceFrom<X> + ?Sized,
impl<T, X> CoerceTo<T> for Xwhere
T: CoerceFrom<X> + ?Sized,
fn coerce_rc_to(self: Rc<X>) -> Rc<T>
fn coerce_box_to(self: Box<X>) -> Box<T>
fn coerce_ref_to(&self) -> &T
fn coerce_mut_to(&mut self) -> &mut T
§impl<T> Instrument for T
impl<T> Instrument for T
§fn instrument(self, span: Span) -> Instrumented<Self>
fn instrument(self, span: Span) -> Instrumented<Self>
§fn in_current_span(self) -> Instrumented<Self>
fn in_current_span(self) -> Instrumented<Self>
Source§impl<T> IntoEither for T
impl<T> IntoEither for T
Source§fn into_either(self, into_left: bool) -> Either<Self, Self>
fn into_either(self, into_left: bool) -> Either<Self, Self>
self into a Left variant of Either<Self, Self>
if into_left is true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read moreSource§fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
self into a Left variant of Either<Self, Self>
if into_left(&self) returns true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read more