A collection of crates for SPIFFE workload identity, Workload API clients, SPIRE-specific APIs, and TLS integration.
These crates provide standards-compliant building blocks for integrating SPIFFE and SPIRE into Rust applications.
The project focuses on:
- Correctness and clarity of APIs
- Alignment with SPIFFE specifications
- Conservative security-oriented design
- Explicit dependency and feature management
This repository does not claim formal security audits or guaranteed production fitness. Users should evaluate suitability based on their own requirements and threat models.
These crates can be used independently or layered together, depending on the level of abstraction required.
Standards-aligned SPIFFE identity primitives and clients for the SPIFFE Workload API.
Use this crate if you need:
- X.509 and JWT SVID handling
- Trust bundle management
- Streaming identity updates
- Strongly typed SPIFFE identifiers and trust domains
See the spiffe README for usage and API documentation.
Rust bindings for SPIRE-specific gRPC APIs that are not part of the SPIFFE standards.
Use this crate if you need:
- The SPIRE Delegated Identity API
- Direct interaction with SPIRE agent or server extensions
See the spire-api README for details.
Integration between SPIFFE identities and rustls.
Use this crate if you need:
- Mutual TLS (mTLS) using SPIFFE identities
- Automatic handling of SVID and trust bundle rotation
- TLS-level peer authorization based on SPIFFE IDs
See the spiffe-rustls README for configuration and examples.
Tokio-native async accept/connect helpers for spiffe-rustls configurations.
Use this crate if you need:
- Async TLS connections with Tokio
- Automatic peer SPIFFE ID extraction from TLS connections
TlsAcceptorandTlsConnectorAPIs
See the spiffe-rustls-tokio README for usage and examples.
Most users will interact with one or more of the following:
- SPIFFE identities or Workload API access →
spiffe - SPIRE gRPC APIs →
spire-api - mTLS with SPIFFE over rustls →
spiffe-rustls - Tokio async TLS with SPIFFE →
spiffe-rustls-tokio
Contributions are welcome. Please see CONTRIBUTING.md for guidelines.
# Clone the repository
git clone https://github.com/maxlambrecht/rust-spiffe.git
cd rust-spiffe
# Quick check (formatting + linting + build, no tests)
make check
# Full test suite (formatting + linting + build + tests)
make all
# Run full CI checks locally (includes MSRV verification)
make ci
# Run integration tests (requires SPIRE setup)
make integration-testsSee make help for all available targets.
Please file bugs and feature requests via GitHub Issues.
For security-related issues, please follow the disclosure process described in SECURITY.md.
Licensed under the Apache License, Version 2.0. See LICENSE for details.