# spiffe/spire architecture

> Architecture diagram of the GitHub repository spiffe/spire, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/spiffe/spire
- Repository: https://github.com/spiffe/spire

## Overview

SPIRE establishes workload identity through a server–agent trust system, then serves issued SPIFFE identities and trust bundles to workloads and integrations. The main workflow is node attestation and agent synchronization, followed by workload attestation and delivery of X.509 or JWT SVIDs through the Workload API. The README also documents Envoy SDS, federation, and bundle distribution. The tree and excerpts establish the principal subsystems; some detailed runtime wiring is inferred only where the README explicitly describes the capability.

Main entry points: [`pkg/server/server.go`](https://github.com/spiffe/spire/blob/main/pkg/server/server.go) (Server Runtime), [`pkg/agent/endpoints/workload/handler.go`](https://github.com/spiffe/spire/blob/main/pkg/agent/endpoints/workload/handler.go) (Workload API), [`pkg/server/datastore`](https://github.com/spiffe/spire/tree/main/pkg/server/datastore) (Persistent State), [`pkg/agent/manager/manager.go`](https://github.com/spiffe/spire/blob/main/pkg/agent/manager/manager.go) (Agent Sync Manager)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_server["SPIRE Server"]
  node_server_process["Server Runtime<br/>[server.go]"]
  node_server_api["Server APIs"]
  node_registration["Registration Entries<br/>[service.go]"]
  node_server_node["Node Management<br/>[manager.go]"]
  node_ca_manager["CA and Signing<br/>[manager.go]"]
  node_datastore[("Persistent State")]
end

subgraph group_agent["SPIRE Agent"]
  node_agent_process["Agent Runtime<br/>[agent.go]"]
  node_node_attest["Node Attestation<br/>[node.go]"]
  node_agent_sync["Agent Sync Manager<br/>[manager.go]"]
  node_agent_storage[("Agent Local State<br/>[storage.go]")]
end

subgraph group_workload["Workload Identity"]
  node_workload_attest["Workload Attestors<br/>[workload.go]"]
  node_workload_api["Workload API<br/>[handler.go]"]
  node_svid_store["SVID Store<br/>[service.go]"]
  node_sds["Envoy SDS<br/>[handler.go]"]
end

subgraph group_trust["Trust Distribution"]
  node_bundle_manager["Federated Bundles<br/>[manager.go]"]
  node_bundle_publish["Bundle Publishing<br/>[pubmanager.go]"]
  node_publishers["Publisher Plugins"]
end

subgraph group_shared["Plugin Infrastructure"]
  node_plugins["Plugin Catalog<br/>[catalog.go]"]
end

node_operator(("Operator"))
node_host(("Host or Platform"))
node_workloads(("Workloads"))

node_operator -->|"manages"| node_server_api
node_server_process -->|"serves"| node_server_api
node_server_api -->|"dispatches"| node_registration
node_registration -->|"persists entries"| node_datastore
node_server_process -->|"initializes"| node_ca_manager
node_ca_manager -->|"stores CA state"| node_datastore
node_server_node -->|"prunes nodes"| node_datastore
node_host -->|"provides evidence"| node_node_attest
node_agent_process -->|"runs"| node_node_attest
node_agent_process -->|"runs"| node_agent_sync
node_agent_sync -->|"synchronizes"| node_server_api
node_agent_sync -->|"reads and writes"| node_agent_storage
node_workloads -->|"requests identity"| node_workload_api
node_workload_api -->|"attests workload"| node_workload_attest
node_workload_api -->|"fetches identity"| node_agent_sync
node_workload_api -->|"serves SVID"| node_svid_store
node_workload_api -->|"serves Envoy"| node_sds
node_server_process -->|"starts manager"| node_bundle_manager
node_bundle_manager -->|"reads trust config"| node_datastore
node_server_process -->|"starts publisher"| node_bundle_publish
node_bundle_publish -->|"reads bundle"| node_datastore
node_bundle_publish -->|"dispatches publish"| node_publishers
node_server_process -->|"loads plugins"| node_plugins
node_agent_process -->|"loads plugins"| node_plugins

click node_server_process "https://github.com/spiffe/spire/blob/main/pkg/server/server.go"
click node_server_api "https://github.com/spiffe/spire/tree/main/pkg/server/api"
click node_registration "https://github.com/spiffe/spire/blob/main/pkg/server/api/entry/v1/service.go"
click node_server_node "https://github.com/spiffe/spire/blob/main/pkg/server/node/manager.go"
click node_ca_manager "https://github.com/spiffe/spire/blob/main/pkg/server/ca/manager/manager.go"
click node_datastore "https://github.com/spiffe/spire/tree/main/pkg/server/datastore"
click node_agent_process "https://github.com/spiffe/spire/blob/main/pkg/agent/agent.go"
click node_node_attest "https://github.com/spiffe/spire/blob/main/pkg/agent/attestor/node/node.go"
click node_agent_sync "https://github.com/spiffe/spire/blob/main/pkg/agent/manager/manager.go"
click node_agent_storage "https://github.com/spiffe/spire/blob/main/pkg/agent/storage/storage.go"
click node_workload_attest "https://github.com/spiffe/spire/blob/main/pkg/agent/attestor/workload/workload.go"
click node_workload_api "https://github.com/spiffe/spire/blob/main/pkg/agent/endpoints/workload/handler.go"
click node_svid_store "https://github.com/spiffe/spire/blob/main/pkg/agent/svid/store/service.go"
click node_sds "https://github.com/spiffe/spire/blob/main/pkg/agent/endpoints/sdsv3/handler.go"
click node_bundle_manager "https://github.com/spiffe/spire/blob/main/pkg/server/bundle/client/manager.go"
click node_bundle_publish "https://github.com/spiffe/spire/blob/main/pkg/server/bundle/pubmanager/pubmanager.go"
click node_publishers "https://github.com/spiffe/spire/tree/main/pkg/server/plugin/bundlepublisher"
click node_plugins "https://github.com/spiffe/spire/blob/main/pkg/common/catalog/catalog.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_server_process,node_server_api,node_registration,node_server_node,node_ca_manager,node_datastore toneBlue
class node_agent_process,node_node_attest,node_agent_sync,node_agent_storage toneAmber
class node_workload_attest,node_workload_api,node_svid_store,node_sds toneMint
class node_bundle_manager,node_bundle_publish,node_publishers toneRose
class node_plugins,node_operator,node_host,node_workloads toneIndigo
```

## Components

### SPIRE Server

- [Server Runtime](https://github.com/spiffe/spire/blob/main/pkg/server/server.go): `pkg/server/server.go`
- [Server APIs](https://github.com/spiffe/spire/tree/main/pkg/server/api): `pkg/server/api`
- [Registration Entries](https://github.com/spiffe/spire/blob/main/pkg/server/api/entry/v1/service.go): `pkg/server/api/entry/v1/service.go`
- [Node Management](https://github.com/spiffe/spire/blob/main/pkg/server/node/manager.go): `pkg/server/node/manager.go`
- [CA and Signing](https://github.com/spiffe/spire/blob/main/pkg/server/ca/manager/manager.go): `pkg/server/ca/manager/manager.go`
- [Persistent State](https://github.com/spiffe/spire/tree/main/pkg/server/datastore): `pkg/server/datastore`

### SPIRE Agent

- [Agent Runtime](https://github.com/spiffe/spire/blob/main/pkg/agent/agent.go): `pkg/agent/agent.go`
- [Node Attestation](https://github.com/spiffe/spire/blob/main/pkg/agent/attestor/node/node.go): `pkg/agent/attestor/node/node.go`
- [Agent Sync Manager](https://github.com/spiffe/spire/blob/main/pkg/agent/manager/manager.go): `pkg/agent/manager/manager.go`
- [Agent Local State](https://github.com/spiffe/spire/blob/main/pkg/agent/storage/storage.go): `pkg/agent/storage/storage.go`

### Workload Identity

- [Workload Attestors](https://github.com/spiffe/spire/blob/main/pkg/agent/attestor/workload/workload.go): `pkg/agent/attestor/workload/workload.go`
- [Workload API](https://github.com/spiffe/spire/blob/main/pkg/agent/endpoints/workload/handler.go): `pkg/agent/endpoints/workload/handler.go`
- [SVID Store](https://github.com/spiffe/spire/blob/main/pkg/agent/svid/store/service.go): `pkg/agent/svid/store/service.go`
- [Envoy SDS](https://github.com/spiffe/spire/blob/main/pkg/agent/endpoints/sdsv3/handler.go): `pkg/agent/endpoints/sdsv3/handler.go`

### Trust Distribution

- [Federated Bundles](https://github.com/spiffe/spire/blob/main/pkg/server/bundle/client/manager.go): `pkg/server/bundle/client/manager.go`
- [Bundle Publishing](https://github.com/spiffe/spire/blob/main/pkg/server/bundle/pubmanager/pubmanager.go): `pkg/server/bundle/pubmanager/pubmanager.go`
- [Publisher Plugins](https://github.com/spiffe/spire/tree/main/pkg/server/plugin/bundlepublisher): `pkg/server/plugin/bundlepublisher`

### Plugin Infrastructure

- [Plugin Catalog](https://github.com/spiffe/spire/blob/main/pkg/common/catalog/catalog.go): `pkg/common/catalog/catalog.go`

### Other components

- **Operator**
- **Host or Platform**
- **Workloads**

## Connections

- Operator → Server APIs: manages
- Server Runtime → Server APIs: serves
- Server APIs → Registration Entries: dispatches
- Registration Entries → Persistent State: persists entries
- Server Runtime → CA and Signing: initializes
- CA and Signing → Persistent State: stores CA state
- Node Management → Persistent State: prunes nodes
- Host or Platform → Node Attestation: provides evidence
- Agent Runtime → Node Attestation: runs
- Agent Runtime → Agent Sync Manager: runs
- Agent Sync Manager → Server APIs: synchronizes
- Agent Sync Manager → Agent Local State: reads and writes
- Workloads → Workload API: requests identity
- Workload API → Workload Attestors: attests workload
- Workload API → Agent Sync Manager: fetches identity
- Workload API → SVID Store: serves SVID
- Workload API → Envoy SDS: serves Envoy
- Server Runtime → Federated Bundles: starts manager
- Federated Bundles → Persistent State: reads trust config
- Server Runtime → Bundle Publishing: starts publisher
- Bundle Publishing → Persistent State: reads bundle
- Bundle Publishing → Publisher Plugins: dispatches publish
- Server Runtime → Plugin Catalog: loads plugins
- Agent Runtime → Plugin Catalog: loads plugins