SPIFFE

pkg/auth/spiffe fetches the workload’s X.509-SVID from the SPIFFE Workload API (e.g. the SPIRE agent socket) and provides a *spiffe.Source in DI.

• Init never waits for the agent. The source connects in the background; TLS handshakes fail until the first SVID arrives.
• Readiness (registered on *health.Health when present) is false until then and whenever the current SVID has expired.
• Rotation needs no restart.
• Under a production profile, a .local trust domain is refused.

spiffe.NewModule(),
connect.NewModule(connect.WithTLSProvider(spiffe.ServerTLS())),

spiffe.ServerTLS() accepts any member of the trust domain at the handshake (the connect server enforces its own caller allow-list); spiffe.ClientTLS(serverID) accepts only the expected server. spiffetest provides a fake Workload API and CA for tests.

Configuration Reference

Config path: modules.auth.spiffe.<name>

socket_pathstring

socketPath is the Workload API address, e.g. unix:///spiffe-workload-api/spire-agent.sock

envLAKTA_MODULES__AUTH__SPIFFE__<NAME>__SOCKET_PATH

trust_domainstring

trustDomain is the trust domain peers must belong to

envLAKTA_MODULES__AUTH__SPIFFE__<NAME>__TRUST_DOMAIN

Code-only options