Function build_spiffe_mtls_config 

pub fn build_spiffe_mtls_config(
    role: SpiffeMtlsRole,
    svid: &SpiffeSvid,
    trust_bundle: &SpiffeTrustBundle,
) -> Result<SpiffeMtlsConfig, TlsError>

Build a SPIFFE-aware mTLS rustls config from an X.509 SVID and a trust bundle. This is the integration point between the mesh domain (which fetches SVIDs from the SPIRE Workload API) and the TLS machinery here.

The SVID’s cert chain and private key are loaded as the presented certificate; the trust bundle is loaded as the peer-verification root store. The resulting config uses rustls’s default certificate verifier (which validates the chain against the root store).

Role

• SpiffeMtlsRole::Server: builds a ServerConfig that presents the SVID as the server cert and verifies peer (client) SVIDs against the trust bundle (with client auth required).
• SpiffeMtlsRole::Client: builds a ClientConfig that presents the SVID as the client cert and verifies peer (server) SVIDs against the trust bundle.