Trait WorkloadApiTransport 

pub trait WorkloadApiTransport:
    Send
    + Sync
    + 'static {
    // Required methods
    fn fetch_x509_svid<'life0, 'async_trait>(
        &'life0 self,
    ) -> Pin<Box<dyn Future<Output = Result<Vec<SpiffeSvid>, SpiffeError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait;
    fn fetch_x509_bundle<'life0, 'async_trait>(
        &'life0 self,
    ) -> Pin<Box<dyn Future<Output = Result<SpiffeTrustBundle, SpiffeError>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait;
}

The transport abstraction for the SPIRE Workload API. The production implementation (GrpcWorkloadApi) uses tonic over a Unix domain socket (ent-gated); tests use FakeWorkloadApi.

The trait is async via async-trait (dyn-compatible, the same pattern as the extensions traits). The methods mirror the SPIRE Workload API’s FetchX509SVID and FetchX509Bundle RPCs.

Required Methods

fn fetch_x509_svid<'life0, 'async_trait>( &'life0 self, ) -> Pin<Box<dyn Future<Output = Result<Vec<SpiffeSvid>, SpiffeError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Fetch the workload’s X.509 SVIDs from the Workload API. The response contains one SVID per SPIFFE ID the workload is authorized to present (typically one). The SVID’s cert chain and private key are DER bytes; the expiry is seconds since the Unix epoch.

fn fetch_x509_bundle<'life0, 'async_trait>( &'life0 self, ) -> Pin<Box<dyn Future<Output = Result<SpiffeTrustBundle, SpiffeError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Fetch the trust bundle (the SPIRE signing CAs) for the configured trust domain from the Workload API. The bundle’s CA certs are DER bytes; the mTLS TLS config uses them as the peer-verification root store.

Implementors

impl WorkloadApiTransport for FakeWorkloadApi