How spiffe/spire works
SPIRE establishes workload identity through a server–agent trust system, then serves issued SPIFFE identities and trust bundles to workloads and integrations. The main workflow is node attestation and agent synchronization, followed by workload attestation and delivery of X.509 or JWT SVIDs through the Workload API. The README also documents Envoy SDS, federation, and bundle distribution. The tree and excerpts establish the principal subsystems; some detailed runtime wiring is inferred only where the README explicitly describes the capability.
Main entry points: server.go Server Runtime · handler.go Workload API · datastore Persistent State · manager.go Agent Sync Manager
Components 21
SPIRE Server
- Server Runtime
pkg/server/server.go - Server APIs
pkg/server/api - Registration Entries
pkg/server/api/entry/v1/service.go - Node Management
pkg/server/node/manager.go - CA and Signing
pkg/server/ca/manager/manager.go - Persistent State
pkg/server/datastore
SPIRE Agent
- Agent Runtime
pkg/agent/agent.go - Node Attestation
pkg/agent/attestor/node/node.go - Agent Sync Manager
pkg/agent/manager/manager.go - Agent Local State
pkg/agent/storage/storage.go
Workload Identity
- Workload Attestors
pkg/agent/attestor/workload/workload.go - Workload API
pkg/agent/endpoints/workload/handler.go - SVID Store
pkg/agent/svid/store/service.go - Envoy SDS
pkg/agent/endpoints/sdsv3/handler.go
Trust Distribution
- Federated Bundles
pkg/server/bundle/client/manager.go - Bundle Publishing
pkg/server/bundle/pubmanager/pubmanager.go - Publisher Plugins
pkg/server/plugin/bundlepublisher
Plugin Infrastructure
- Plugin Catalog
pkg/common/catalog/catalog.go
Other components
- Operator
- Host or Platform
- Workloads
Connections 24
- Operator → Server APIs: manages
- Server Runtime → Server APIs: serves
- Server APIs → Registration Entries: dispatches
- Registration Entries → Persistent State: persists entries
- Server Runtime → CA and Signing: initializes
- CA and Signing → Persistent State: stores CA state
- Node Management → Persistent State: prunes nodes
- Host or Platform → Node Attestation: provides evidence
- Agent Runtime → Node Attestation: runs
- Agent Runtime → Agent Sync Manager: runs
- Agent Sync Manager → Server APIs: synchronizes
- Agent Sync Manager → Agent Local State: reads and writes
- Workloads → Workload API: requests identity
- Workload API → Workload Attestors: attests workload
- Workload API → Agent Sync Manager: fetches identity
- Workload API → SVID Store: serves SVID
- Workload API → Envoy SDS: serves Envoy
- Server Runtime → Federated Bundles: starts manager
- Federated Bundles → Persistent State: reads trust config
- Server Runtime → Bundle Publishing: starts publisher
- Bundle Publishing → Persistent State: reads bundle
- Bundle Publishing → Publisher Plugins: dispatches publish
- Server Runtime → Plugin Catalog: loads plugins
- Agent Runtime → Plugin Catalog: loads plugins