Top
This file defines the Agent message and related types representing
Cofide Agents deployed in clusters registered with the Connect control plane.
Agent represents a Cofide Agent deployed in a cluster. The agent facilitates
cluster registration with the Connect control plane and provides dynamic
control plane functionality including federated service management.
AgentStatus reports the current operational status of a Cofide Agent.
| Field | Type | Label | Description |
|---|
| status | AgentStatusCode | optional | |
| status_message | string | optional | |
| last_updated | int64 | optional | Unix timestamp (seconds) of the last status update. |
AgentStatusCode enumerates the possible operational states of a Cofide Agent.
| Name | Number | Description |
|---|
| AGENT_STATUS_CODE_UNSPECIFIED | 0 | |
| AGENT_STATUS_CODE_RUNNING | 1 | |
| AGENT_STATUS_CODE_STOPPED | 2 | |
| AGENT_STATUS_CODE_ERROR | 3 | |
| AGENT_STATUS_CODE_STARTING | 4 | |
Top
This file defines the APBinding message and related types representing
attestation policy bindings in the Connect control plane. An APBinding
associates an attestation policy with a trust zone, enabling identity
issuance for matching workloads within that zone.
APBinding binds an attestation policy to a trust zone, enabling Connect to
issue SPIFFE identities to workloads that match the policy within that zone.
Optionally, federations can be specified to restrict which federated trust
zones will be visible to matching workloads, allowing the same policy to be
re-used across multiple trust zones.
APBindingFederation identifies a trust zone that is included in the federated
scope of an attestation policy binding.
| Field | Type | Label | Description |
|---|
| trust_zone_id | string | optional | |
Top
| Field | Type | Label | Description |
|---|
| type | string | | The type of the selector. This is typically the name of the plugin that produces the selector. |
| value | string | | The value of the selector. |
| Name | Number | Description |
|---|
| MATCH_BEHAVIOR_EXACT_UNSPECIFIED | 0 | Indicates that the selectors in this match are equal to the candidate selectors, independent of ordering. Example: Given: - ‘e1 { Selectors: [“a:1”, “b:2”, “c:3”]}’ - ‘e2 { Selectors: [“a:1”, “b:2”]}’ - ‘e3 { Selectors: [“a:1”]}’ Operation: - MATCH_EXACT [“a:1”, “b:2”] Entries that match: - ‘e2’ |
| MATCH_BEHAVIOR_SUBSET | 1 | Indicates that all candidates which have a non-empty subset of the provided set of selectors will match. Example: Given: - ‘e1 { Selectors: [“a:1”, “b:2”, “c:3”]}’ - ‘e2 { Selectors: [“a:1”, “b:2”]}’ - ‘e3 { Selectors: [“a:1”]}’ Operation: - MATCH_SUBSET [“a:1”] Entries that match: - ‘e1’ |
| MATCH_BEHAVIOR_SUPERSET | 2 | Indicates that all candidates which are a superset of the provided selectors will match. Example: Given: - ‘e1 { Selectors: [“a:1”, “b:2”, “c:3”]}’ - ‘e2 { Selectors: [“a:1”, “b:2”]}’ - ‘e3 { Selectors: [“a:1”]}’ Operation: - MATCH_SUPERSET [“a:1”, “b:2”] Entries that match: - ‘e1’ - ‘e2’ |
| MATCH_BEHAVIOR_ANY | 3 | Indicates that all candidates which have at least one of the provided set of selectors will match. Example: Given: - ‘e1 { Selectors: [“a:1”, “b:2”, “c:3”]}’ - ‘e2 { Selectors: [“a:1”, “b:2”]}’ - ‘e3 { Selectors: [“a:1”]}’ Operation: - MATCH_ANY [“a:1”] Entries that match: - ‘e1’ - ‘e2’ - ‘e3’ |
Top
This file defines the AttestationPolicy message and related types used to
specify the criteria for issuing SPIFFE identities to workloads. Supported
policy types cover Kubernetes workload attestation (APKubernetes), static
attestation (APStatic), and TPM-based node attestation (APTPMNode).
APKubernetes represents a Kubernetes attestation policy.
Identities are managed dynamically in the control plane based on workload
observations.
| Field | Type | Label | Description |
|---|
| namespace_selector | APLabelSelector | optional | |
| pod_selector | APLabelSelector | optional | |
| dns_name_templates | string | repeated | |
| spiffe_id_path_template | string | optional | Custom SPIFFE ID path format for Connect identity issuance This defines the identity path appended to domain of the trust zone it is bound to |
An example spiffe_id_path_template and corresponding SPIFFE ID: ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }} => spiffe://<trust_domain_of_trust_zone>/ns/…/sa/…
This is supported in both Connect and OSS SPIRE via spire-controller-manager Note that the supported templates are a subset of those in the SCM
Valid template components: {{ .ClusterName }} - Name of cluster {{ .PodMeta.Namespace }} - Namespace of the pod {{ index .PodMeta.Labels “key” }} - Pod label value of a provided key {{ index .PodMeta.Annotations “key” }} - Pod annotation value of a provided key {{ .PodSpec.ServiceAccountName }} - Service account of the pod |
This definition has been adapted from the LabelSelector message in Kubernetes.
https://github.com/kubernetes/apimachinery/blob/master/pkg/apis/meta/v1/generated.proto
APMatchExpression represents a single label requirement using a key, operator,
and set of values. Follows the Kubernetes LabelSelectorRequirement semantics.
APStatic represents a static attestation policy
No observations are required before identities can be issued to matching workloads.
| Field | Type | Label | Description |
|---|
| spiffe_id | string | optional | Deprecated. |
| spiffe_id_path | string | optional | |
| parent_id_path | string | optional | |
| selectors | spire.api.types.Selector | repeated | |
| dns_names | string | repeated | |
| store_svid | bool | | When true, indicates to SPIRE agents that the x509 SVID should be stored in the svidstore (if the svidstore agent plugin is enabled). |
APTPMNode represents a node (agent) attesting using a Trusted Platform Module (TPM).
| Field | Type | Label | Description |
|---|
| attestation | TPMAttestation | | |
| selector_values | string | repeated | selector_values are the values of node selectors to use for this node. The key of the selectors will be “tpm”. |
AttestationPolicy defines criteria used to issue a SPIFFE identity to a
workload. Policies specify attributes of the workload that must be attested
before an identity (SVID) is issued. Policies are bound to trust zones via
APBindings and support Kubernetes, static, and TPM node attestation methods.
TPMAttestation represents attestation requirements for a node (agent) attesting using a Trusted
Platform Module (TPM).
| Field | Type | Label | Description |
|---|
| ek_hash | string | optional | ek_hash is the SHA256 hash of the TPM’s Endorsement Key (EK). |
Top
A link to another entity.
An auditable event that occurred within the system.
| Field | Type | Label | Description |
|---|
| id | string | | Unique identifier for the event. |
| occurred_at | google.protobuf.Timestamp | | Timestamp of the event. This is when the event was recorded, clock drift or system delays may mean that this does not align precisely with timestamps on linked resources. |
| type | EventType | | Type of the event, so that events can be filtered on read. |
| message | string | | Human friendly description of what occurred. |
| links | EntityLink | repeated | Linked entities. An event may be linked to many entities. These links will persist even if the entities themselves are removed so it is always possible to trace the events back through the system. At least one link is required. |
| data | bytes | | JSON-serialised data specific to the event type, suitable for display and reconstructing a sequence of actions. The schema of this field is intentionally independent of the current proto definitions to ensure historical accuracy - the data represents the state of entities at the time of the event, not their current schema. |
| actor | string | | Identifier of the actor that caused the event. For users this is the JWT sub claim, for workloads this is their SPIFFE ID, and for internal events not triggered by an external actor this is “system”. |
| source_ip | string | | Source IP address of the request that caused the event, as observed by the Envoy sidecar proxy. Not present for internally-generated events (e.g. where actor is “system”). |
| outcome | Outcome | | Outcome of the action that caused the event. |
| server_version | string | | Version of the Connect server software that generated this event (e.g. “1.2.3”). |
Entity types audit events can be linked to
| Name | Number | Description |
|---|
| ENTITY_TYPE_UNSPECIFIED | 0 | |
| ENTITY_TYPE_ATTESTATION_POLICY | 1 | |
| ENTITY_TYPE_ATTESTATION_POLICY_BINDING | 2 | |
| ENTITY_TYPE_CLUSTER | 3 | |
| ENTITY_TYPE_COFIDE_AGENT | 4 | |
| ENTITY_TYPE_EXCHANGE_POLICY | 5 | |
| ENTITY_TYPE_FEDERATED_SERVICE | 6 | |
| ENTITY_TYPE_FEDERATION | 7 | |
| ENTITY_TYPE_NODE | 8 | |
| ENTITY_TYPE_ORGANIZATION | 9 | |
| ENTITY_TYPE_ROLE_BINDING | 10 | |
| ENTITY_TYPE_TRUST_ZONE | 11 | |
| ENTITY_TYPE_TRUST_ZONE_SERVER | 12 | |
| ENTITY_TYPE_WORKLOAD | 13 | |
Auditable event types
| Name | Number | Description |
|---|
| EVENT_TYPE_UNSPECIFIED | 0 | |
| EVENT_TYPE_ATTESTATION_POLICY_CREATION | 1 | Attestation Policy |
| EVENT_TYPE_ATTESTATION_POLICY_UPDATE | 2 | |
| EVENT_TYPE_ATTESTATION_POLICY_DELETION | 3 | |
| EVENT_TYPE_ATTESTATION_POLICY_BINDING_CREATION | 4 | Attestation Policy Binding |
| EVENT_TYPE_ATTESTATION_POLICY_BINDING_UPDATE | 5 | |
| EVENT_TYPE_ATTESTATION_POLICY_BINDING_DELETION | 6 | |
| EVENT_TYPE_CLUSTER_CREATION | 7 | Cluster |
| EVENT_TYPE_CLUSTER_UPDATE | 8 | |
| EVENT_TYPE_CLUSTER_DELETION | 9 | |
| EVENT_TYPE_COFIDE_AGENT_REGISTRATION | 10 | Cofide Agent |
| EVENT_TYPE_EXCHANGE_POLICY_CREATION | 11 | Exchange Policy |
| EVENT_TYPE_EXCHANGE_POLICY_UPDATE | 12 | |
| EVENT_TYPE_EXCHANGE_POLICY_DELETION | 13 | |
| EVENT_TYPE_FEDERATED_SERVICE_REGISTRATION | 14 | Federated Service |
| EVENT_TYPE_FEDERATED_SERVICE_UPDATE | 15 | |
| EVENT_TYPE_FEDERATED_SERVICE_DEREGISTRATION | 16 | |
| EVENT_TYPE_FEDERATION_CREATION | 17 | Federation |
| EVENT_TYPE_FEDERATION_DELETION | 19 | |
| EVENT_TYPE_NODE_ATTESTATION | 20 | Node Attestation |
| EVENT_TYPE_NODE_DELETION | 21 | |
| EVENT_TYPE_NODE_PRUNING | 22 | |
| EVENT_TYPE_ROLE_BINDING_CREATION | 23 | Role Binding |
| EVENT_TYPE_ROLE_BINDING_UPDATE | 24 | |
| EVENT_TYPE_ROLE_BINDING_DELETION | 25 | |
| EVENT_TYPE_TRUST_ZONE_CREATION | 26 | Trust Zone |
| EVENT_TYPE_TRUST_ZONE_UPDATE | 27 | |
| EVENT_TYPE_TRUST_ZONE_DELETION | 28 | |
| EVENT_TYPE_TRUST_ZONE_SERVER_CREATION | 29 | Trust Zone Server |
| EVENT_TYPE_TRUST_ZONE_SERVER_UPDATE | 30 | |
| EVENT_TYPE_TRUST_ZONE_SERVER_DELETION | 31 | |
| EVENT_TYPE_TRUST_ZONE_SERVER_STATUS_UPDATE | 32 | |
| EVENT_TYPE_WORKLOAD_CREATION | 33 | Workload |
| EVENT_TYPE_WORKLOAD_DELETION | 34 | |
| EVENT_TYPE_TOKEN_EXCHANGE | 35 | Token Exchange |
Outcome of the action that caused the event.
| Name | Number | Description |
|---|
| OUTCOME_UNSPECIFIED | 0 | |
| OUTCOME_SUCCESS | 1 | |
| OUTCOME_DENIED | 2 | |
Top
| Field | Type | Label | Description |
|---|
| enabled | bool | | Whether to enable the k8s psat node attestor plugin with a Connect datasource. |
| allowed_service_accounts | K8sPsatConfig.ServiceAccount | repeated | Namespace and name of service accounts agents can use tokens from to attest nodes in this cluster. At least 1 must be provided if the SPIRE server is outside the cluster. |
| allowed_node_label_keys | string | repeated | Node labels that can be used as selectors in this cluster. |
| allowed_pod_label_keys | string | repeated | Pod labels that can be used as selectors in this cluster. |
| api_server_ca_cert | bytes | | CA certificate of the cluster’s API server. Optional, but required if the SPIRE server is outside the cluster and the cluster’s API server CA is not already trusted by the SPIRE server (very likely). |
| api_server_url | string | | Cluster’s API server URL. Required if the SPIRE server is outside the cluster. |
| api_server_tls_server_name | string | | Alternative TLS server name to verify the presented certificate with if the hostname of the API server URL is not in the presented certificate. |
| api_server_proxy_url | string | | Proxy URL of the API server (if running behind a proxy). |
| spire_server_audience | string | | Audience the SPIRE server should use in the JWT presented to the cluster’s API server. Required if the SPIRE server is outside the cluster. |
| Field | Type | Label | Description |
|---|
| namespace | string | | |
| service_account_name | string | | |
| Field | Type | Label | Description |
|---|
| kind | string | optional | |
| k8s_psat_config | K8sPsatConfig | | Configuration for the k8s psat node attestor plugin when using a Connect datasource with remote clusters. |
Configuration for additional server plugins goes here. More than one may be enabled, to allow node attestation in a cluster to be done in multiple different ways. |
| Name | Number | Description |
|---|
| TRUST_PROVIDER_KIND_UNSPECIFIED | 0 | |
| TRUST_PROVIDER_KIND_KUBERNETES | 1 | |
Top
This file defines the Cluster message representing a single environment
(e.g. a Kubernetes cluster) onboarded onto the Connect control plane.
Cluster represents a single environment (e.g. a Kubernetes cluster) onboarded
onto Connect. Each cluster belongs to a trust zone.
| Field | Type | Label | Description |
|---|
| id | string | optional | |
| name | string | optional | |
| org_id | string | optional | |
| trust_zone_id | string | optional | |
| kubernetes_context | string | optional | The kubeconfig context name used to interact with this cluster. |
| trust_provider | proto.trust_provider.v1alpha1.TrustProvider | optional | The node attestation trust provider configuration for this cluster. |
| extra_helm_values | google.protobuf.Struct | optional | Additional Helm values to pass to the Cofide SPIRE chart deployment. |
| profile | string | optional | |
| external_server | bool | optional | Whether the SPIRE server for this cluster’s trust zone is deployed externally (i.e. not within this cluster). |
| oidc_issuer_url | string | optional | OIDC issuer URL for the Kubernetes API server, used for k8s_psat node attestation. |
| oidc_issuer_ca_cert | bytes | optional | PEM-encoded CA certificate for the OIDC issuer, if it uses a private CA. |
| created_at | google.protobuf.Timestamp | | Time of resource creation by user. |
| last_updated_at | google.protobuf.Timestamp | | Time of last resource update by user. |
Top
This file defines the Federation message representing a trust relationship
between two trust zones in the Connect control plane. Federations allow
workloads in each zone to present their SPIFFE identities to workloads in
the other, enabling secure communication across zone boundaries.
Federation represents a trust relationship between two trust zones. It allows
workloads in each zone to establish secure connections with workloads in the
other, while keeping each zone’s root of trust securely isolated. Attestation
policies on AP bindings determine which workloads are permitted to federate.
| Field | Type | Label | Description |
|---|
| id | string | optional | |
| org_id | string | optional | |
| trust_zone_id | string | optional | The local trust zone that initiates the federation. |
| remote_trust_zone_id | string | optional | The remote trust zone that this federation points to. |
| created_at | google.protobuf.Timestamp | | Time of resource creation by user. |
| last_updated_at | google.protobuf.Timestamp | | Time of last resource update by user. |
Top
| Field | Type | Label | Description |
|---|
| data_source | string | optional | |
| provision | string | optional | |
Top
| Field | Type | Label | Description |
|---|
| trust_domain | string | | The name of the trust domain the bundle belongs to (e.g., “example.org”). |
| x509_authorities | X509Certificate | repeated | X.509 authorities for authenticating X509-SVIDs. |
| jwt_authorities | JWTKey | repeated | JWT authorities for authenticating JWT-SVIDs. |
| refresh_hint | int64 | | A hint on how often the bundle should be refreshed from the bundle provider, in seconds. Can be zero (meaning no hint available). |
| sequence_number | uint64 | | The sequence number of the bundle. |
| Field | Type | Label | Description |
|---|
| x509_authorities | bool | | x509_authorities field mask. |
| jwt_authorities | bool | | jwt_authorities field mask. |
| refresh_hint | bool | | refresh_hint field mask. |
| sequence_number | bool | | sequence_number field mask. |
| Field | Type | Label | Description |
|---|
| public_key | bytes | | The PKIX encoded public key. |
| key_id | string | | The key identifier. |
| expires_at | int64 | | When the key expires (seconds since Unix epoch). If zero, the key does not expire. |
| tainted | bool | | This authority is no longer secure and must not be used |
| Field | Type | Label | Description |
|---|
| asn1 | bytes | | The ASN.1 DER encoded bytes of the X.509 certificate. |
| tainted | bool | | This authority is no longer secure and must not be used. |
Top
This file defines the TrustZone message and related types representing a
SPIFFE trust domain within the Connect control plane. A trust zone encompasses
one or more clusters and/or nodes within a single trust boundary and can
federate with other trust zones to enable secure cross-zone connectivity.
TrustZone represents one or more clusters and/or nodes within a
single trust boundary. Each trust zone is a SPIFFE trust domain: workload
identities (SVIDs) issued within the zone carry the trust domain as the root
of their SPIFFE ID. Federations can be created between trust zones to allow
selected workloads to establish secure connectivity across zone boundaries.
| Field | Type | Label | Description |
|---|
| name | string | | |
| trust_domain | string | | The SPIFFE trust domain for this zone, e.g. “example.com”. |
| bundle_endpoint_url | string | optional | URL of the SPIFFE bundle endpoint, used by remote trust zones to fetch this zone’s trust bundle for federation. |
| bundle | spire.api.types.Bundle | optional | The current SPIRE trust bundle for this zone, containing the root CA certificates. |
| jwt_issuer | string | optional | JWT issuer URL for SVIDs issued within this trust zone. |
| bundle_endpoint_profile | BundleEndpointProfile | optional | The SPIFFE federation profile used to serve and consume trust bundles. |
| id | string | optional | |
| is_management_zone | bool | | Whether this trust zone hosts the Connect management plane. |
| org_id | string | optional | |
| created_at | google.protobuf.Timestamp | | Time of resource creation by user. |
| last_updated_at | google.protobuf.Timestamp | | Time of last resource update by user. |
BundleEndpointProfile specifies the SPIFFE federation profile used to serve
and consume trust bundles for a trust zone.
| Name | Number | Description |
|---|
| BUNDLE_ENDPOINT_PROFILE_UNSPECIFIED | 0 | |
| BUNDLE_ENDPOINT_PROFILE_HTTPS_SPIFFE | 1 | SPIFFE-authenticated bundle endpoint. |
| BUNDLE_ENDPOINT_PROFILE_HTTPS_WEB | 2 | Web PKI-authenticated bundle endpoint. |
Top
Top
This file defines the FederatedService message and related types used to
describe services that are exposed for secure cross-zone connectivity. A
federated service enables workloads in remote trust zones to discover and
connect to a service using mTLS.
FederatedService simplifies secure connectivity between workloads in different
trust zones. Combined with a federation, the Cofide Agent facilitates
discovery of and mTLS connectivity to this service from remote trust zones.
Connectivity is available via xDS (Envoy) and the Cofide Go SDK.
FederatedServices are typically created from a Kubernetes Custom Resource
applied to the cluster in which the service runs.
| Field | Type | Label | Description |
|---|
| id | string | | |
| name | string | | |
| namespace | string | | |
| cluster_name | string | | |
| trust_domain | string | | The SPIFFE trust domain of the cluster in which this service runs. |
| workload_labels | FederatedService.WorkloadLabelsEntry | repeated | Kubernetes labels used to select the pods backing this service. |
| exported_trust_domains | string | repeated | The remote trust domains to which this service is exported. |
| port | uint32 | | |
| gateway_entries | GatewayEntry | repeated | Gateway entries discovered automatically by the Cofide Agent. |
| gateway_specs | GatewaySpec | repeated | Gateway addresses manually specified in the FederatedService resource. |
| tls_mode | TLSMode | | |
| created_at | google.protobuf.Timestamp | | Time of resource creation by user. |
| last_updated_at | google.protobuf.Timestamp | | Time of last resource update by user. |
| spiffe_id_paths | string | repeated | SPIFFE ID paths of the application(s) referenced by this Federated Service Consumers should cleanly handle presence/absence of a leading slash |
GatewayEntry is a gateway address discovered automatically by the Cofide Agent
for routing traffic to a federated service.
GatewaySpec is a manually specified gateway address for a federated service,
provided when automatic gateway discovery is not available or sufficient.
TLSMode specifies the mutual TLS mode used for a federated service connection.
| Name | Number | Description |
|---|
| TLS_MODE_UNSPECIFIED | 0 | |
| TLS_MODE_MTLS | 1 | Standard SPIFFE mTLS using SPIRE-issued SVIDs. |
| TLS_MODE_ISTIO_MTLS | 2 | Istio-managed mTLS, for clusters using an Istio service mesh. |
Top
This file defines the AgentService gRPC service, which is used by Cofide
Agents to register with the Connect control plane and to manage the federated
services running in their cluster.
| Field | Type | Label | Description |
|---|
| trust_zone_id | string | optional | |
| cluster_id | string | optional | |
| Field | Type | Label | Description |
|---|
| agent_token | string | optional | |
| Field | Type | Label | Description |
|---|
| service_id | string | | |
| Field | Type | Label | Description |
|---|
| service_id | string | | |
| Field | Type | Label | Description |
|---|
| service_id | string | | |
| Field | Type | Label | Description |
|---|
| org_id | string | | |
| Field | Type | Label | Description |
|---|
| service_id | string | | |
| Field | Type | Label | Description |
|---|
| service_id | string | | |
AgentService is used by Cofide Agents to register with the Connect control
plane and to manage the federated services running in their cluster.
Top
This file defines the APBindingService gRPC service for managing attestation
policy bindings in the Connect control plane. Bindings associate an
attestation policy with a trust zone, enabling SPIFFE identity issuance for
workloads matching the policy within that zone.
| Field | Type | Label | Description |
|---|
| binding_id | string | optional | |
| Field | Type | Label | Description |
|---|
| binding_id | string | optional | |
| Field | Type | Label | Description |
|---|
| org_id | string | optional | |
| trust_zone_id | string | optional | |
| policy_id | string | optional | |
APBindingService manages attestation policy bindings. Bindings associate an
attestation policy with a trust zone, enabling Connect to issue SPIFFE
identities to workloads that match the policy within that zone. Bindings can
also specify federated trust zones to provide the bundles of federated trust
zones to matching workloads.
Top
This file defines the AttestationPolicyService gRPC service for managing
attestation policies in the Connect control plane. Attestation policies
specify the criteria used to issue SPIFFE identities to workloads and support
Kubernetes, static, and TPM node attestation types.
| Field | Type | Label | Description |
|---|
| policy_id | string | optional | |
| Field | Type | Label | Description |
|---|
| policy_id | string | optional | |
| Field | Type | Label | Description |
|---|
| ek_hash | string | optional | |
AttestationPolicyKind enumerates the supported attestation policy types.
| Name | Number | Description |
|---|
| ATTESTATION_POLICY_KIND_UNSPECIFIED | 0 | |
| ATTESTATION_POLICY_KIND_KUBERNETES | 1 | |
| ATTESTATION_POLICY_KIND_STATIC | 2 | |
| ATTESTATION_POLICY_KIND_TPM_NODE | 3 | |
AttestationPolicyService manages attestation policies. Attestation policies
define the criteria (namespace selectors, pod labels, TPM EK hashes, etc.)
used to issue SPIFFE identities to workloads. Policies are bound to trust
zones via the APBindingService.
Top
PageRequest holds pagination parameters for List RPCs, following AIP-132
https://google.aip.dev/132
| Field | Type | Label | Description |
|---|
| page_size | int32 | | The maximum number of items to return. The service may return fewer than this value. If unspecified, at most 100 items will be returned unless the List RPC documents otherwise (supporting clients that existed pre-pagination). The maximum value is 1000; values above 1000 will be coerced to 1000. |
| page_token | string | | A page token, received from a previous List call. Provide this to retrieve the subsequent page. |
When paginating, all other parameters provided to the List RPC must match the call that provided the page token. |
PageResponse holds pagination fields for List RPC responses, following
AIP-132 https://google.aip.dev/132
| Field | Type | Label | Description |
|---|
| next_page_token | string | | A token, which can be sent as page_token to retrieve the next page. If this field is omitted/empty, there are no subsequent pages. |
Top
Filters are combined with AND, repeated fields are OR’d
| Field | Type | Label | Description |
|---|
| type | proto.audit.v1alpha1.EntityType | | At least one of type or id must be provided. Providing only type matches all events linked to any entity of that type. Providing only id matches all events linked to the entity with that id, regardless of type. |
| id | string | | |
Exclude specifies values to exclude from results. Exclusions are applied after inclusions.
All fields are combined with AND; repeated fields are OR’d (i.e. exclude if any value matches).
| Field | Type | Label | Description |
|---|
| subject_identity | string | | Exchange request details — populated for all outcomes. |
| subject_issuer | string | | |
| actor_identity | string | | |
| actor_issuer | string | | |
| client_id | string | | |
| target_audiences | string | repeated | |
| requested_scopes | string | repeated | |
| outcome | proto.audit.v1alpha1.Outcome | | Whether the exchange was allowed or denied. |
| deny_reason | ExchangeDenyReason | | Why it was denied. Only set when outcome = OUTCOME_DENIED. |
| matched_policy_id | string | | ID of the exchange policy that matched the request. Set for OUTCOME_SUCCESS and for EXCHANGE_DENY_REASON_BLOCKED_BY_POLICY. Absent for EXCHANGE_DENY_REASON_SCOPE_DENIED / EXCHANGE_DENY_REASON_NO_MATCHING_POLICY. |
| source_ip | string | | Source IP of the exchange requester. |
| outbound_identity | string | | Outbound identity set on the exchanged token. Only set when outcome = OUTCOME_SUCCESS. |
| outbound_scopes | string | repeated | Outbound scopes granted on the exchanged token. Only set when outcome = OUTCOME_SUCCESS. |
ExchangeDenyReason distinguishes why a token exchange was denied.
Only relevant when outcome = OUTCOME_DENIED.
| Name | Number | Description |
|---|
| EXCHANGE_DENY_REASON_UNSPECIFIED | 0 | |
| EXCHANGE_DENY_REASON_BLOCKED_BY_POLICY | 1 | A deny-action policy matched the exchange request. |
| EXCHANGE_DENY_REASON_SCOPE_DENIED | 2 | An allow policy matched but the requested scopes exceeded the policy limits. |
| EXCHANGE_DENY_REASON_NO_MATCHING_POLICY | 3 | No policy matched the exchange request. |
AuditService provides visibility into auditable events.
Top
This file defines the ClusterService gRPC service for managing clusters
registered with the Connect control plane. Each cluster belongs to a trust
zone.
| Field | Type | Label | Description |
|---|
| cluster_id | string | optional | |
| Field | Type | Label | Description |
|---|
| cluster_id | string | optional | |
| Field | Type | Label | Description |
|---|
| name | string | optional | |
| org_id | string | optional | |
| trust_zone_id | string | optional | |
ClusterService manages clusters registered with the Connect control plane.
Each cluster belongs to a trust zone.
Top
Represents an attested SPIRE agent
| Field | Type | Label | Description |
|---|
| org_id | string | | Organisation ID |
| trust_zone_id | string | | Trust zone ID |
| spiffe_id | string | | Node SPIFFE ID |
| attestation_data_type | string | | Attestation data type |
| cert_serial_number | string | | Node certificate serial number |
| cert_not_after | int64 | | Node certificate not_after (seconds since unix epoch) |
| new_cert_serial_number | string | | Node certificate serial number |
| new_cert_not_after | int64 | | Node certificate not_after (seconds since unix epoch) |
| selectors | Selector | repeated | Node selectors |
| can_reattest | bool | | CanReattest field (can the attestation safely be deleted and recreated automatically) |
A type which describes the conditions under which a registration
entry is matched.
| Field | Type | Label | Description |
|---|
| type | string | | A selector type represents the type of attestation used in attesting the entity (Eg: AWS, K8). |
| value | string | | The value to be attested. |
Represents a type with a list of Selector.
| Field | Type | Label | Description |
|---|
| entries | Selector | repeated | A list of Selector. |
Top
| Field | Type | Label | Description |
|---|
| attestation_data_type | bool | | |
| cert_serial_number | bool | | |
| cert_not_after | bool | | |
| new_cert_serial_number | bool | | |
| new_cert_not_after | bool | | |
| can_reattest | bool | | |
Node operations request/response messages
| Field | Type | Label | Description |
|---|
| trust_zone_id | string | optional | |
| Field | Type | Label | Description |
|---|
| count | int32 | | |
| Field | Type | Label | Description |
|---|
| spiffe_id | string | | |
| trust_zone_id | string | optional | |
| Field | Type | Label | Description |
|---|
| spiffe_id | string | | |
| trust_zone_id | string | optional | |
Node Selector operations request/response messages
| Field | Type | Label | Description |
|---|
| spiffe_id | string | | |
| trust_zone_id | string | optional | |
| Field | Type | Label | Description |
|---|
| by_attestation_type | string | optional | Filters nodes by attestation type |
| by_banned | bool | optional | Filters nodes by banned status |
| by_expires_before | int64 | optional | Filters nodes that expire before the specified timestamp |
| by_selector_match | ListAttestedNodesRequest.BySelectors | optional | |
| fetch_selectors | bool | optional | Whether to fetch selectors with nodes |
| by_can_reattest | bool | optional | Filters nodes by ability to re-attest |
| trust_zone_id | string | optional | |
Filters nodes by selectors
| Field | Type | Label | Description |
|---|
| valid_at | int64 | optional | |
| trust_zone_id | string | optional | |
| Field | Type | Label | Description |
|---|
| selectors | Selector | repeated | |
| Name | Number | Description |
|---|
| MATCH_BEHAVIOR_EXACT_UNSPECIFIED | 0 | |
| MATCH_BEHAVIOR_SUBSET | 1 | |
| MATCH_BEHAVIOR_SUPERSET | 2 | |
| MATCH_BEHAVIOR_MATCH_ANY | 3 | |
DataStoreService defines the gRPC service for the SPIRE server DataStore interface
Top
ExchangePolicy defines a rule for permitting or denying Credex token exchanges
within a trust zone
| Field | Type | Label | Description |
|---|
| id | string | | The unique ID of the exchange policy. Generated by the server. |
| org_id | string | | Organization to which the exchange policy belongs. Derived from the trust zone by the API service. |
| name | string | | |
| trust_zone_id | string | | Trust zone to which this policy applies. Immutable after creation. |
| action | ExchangePolicyAction | optional | Action to take when all conditions match. Defaults to ALLOW when unset. |
| subject_identity | StringSet | | Match conditions on the inbound subject token |
| subject_issuer | StringSet | | |
| subject_audience | StringSet | | Match condition on the audience of the inbound subject token. Useful for OIDC ID tokens which use the IdP’s ID for the client. |
| actor_identity | StringSet | | Match conditions on the optional inbound actor |
| actor_issuer | StringSet | | |
| client_id | StringSet | | Match condition on the OAuth client_id presenting the exchange request |
| target_audience | StringSet | | Match condition on the requested target audience |
| outbound_identity | string | | Outbound identity to set on the exchanged token. Only relevant when action is ALLOW. |
| outbound_scopes | string | repeated | Outbound scopes to grant. Only relevant when action is ALLOW. |
| oauth_as | OutboundOAuthAS | | An OAuth Authorization Server (AS). |
| created_at | google.protobuf.Timestamp | | Time of resource creation by user. |
| last_updated_at | google.protobuf.Timestamp | | Time of last resource update by user. |
| external_hooks | ExternalHook | repeated | Post-matching hooks that transform outbound token claims before Credex mints them. |
ExternalHook defines an HTTP endpoint that Credex calls after an exchange policy
matches, allowing the hook to inspect and modify the outbound token claims before
the token is minted. Hooks are invoked in the order they appear in the policy.
If any hook returns an error or times out, the exchange is denied.
| Field | Type | Label | Description |
|---|
| name | string | | Unique name for this hook within the policy. Used to identify the hook in logs. |
| description | string | | Human-readable description of the hook’s purpose. |
| url | string | | The HTTPS URL of the external hook service. Credex will POST the inbound subject/actor claims and the outbound token claims to this URL and expect a JSON patch to apply to the outbound claims in return. TODO: link to API definition of request/response format. |
| spiffe_mtls | SpiffeMtlsAuth | | Authenticate to the hook using SPIFFE mTLS. Credex will present its SVID and verify the hook’s certificate against the specified SPIFFE ID. |
| timeout | google.protobuf.Duration | | Maximum time to wait for the hook to respond. Defaults to a server-defined value when unset. If the hook does not respond within this duration, the exchange is denied. |
Outbound OAuth Authorization Server (AS).
| Field | Type | Label | Description |
|---|
| grant_type | string | | OAuth grant type to use. Currently “client_credentials” is supported. |
| issuer_url | string | | Issuer URL for the AS. At least one of issuer_url and token_url must be specified. |
| token_url | string | | Token URL for the AS. At least one of issuer_url and token_url must be specified. If token_url is not specified, Credex will use RFC 8414 OAuth AS metadata or OIDC Discovery to determine the token URL. |
| audiences | string | repeated | Audiences to use in the request. If absent, the token URL will be used as the audience. |
| timeout | google.protobuf.Duration | | Maximum time to wait AS to respond. Defaults to a server-defined value when unset. If the AS does not respond within this duration, the exchange is denied. |
SpiffeMtlsAuth configures SPIFFE mTLS authentication for an ExternalHook.
| Field | Type | Label | Description |
|---|
| spiffe_id | string | | The SPIFFE ID of the hook service. Credex verifies that the hook’s TLS certificate encodes this SPIFFE ID before sending any data. |
| Field | Type | Label | Description |
|---|
| exact | string | | Exact string equality. |
| glob | string | | Glob pattern (e.g. spiffe://trust.domain/ns//sa/). |
StringSet holds a collection of StringMatchers evaluated with OR semantics.
ExchangePolicyAction determines whether a Credex token exchange is permitted
when all conditions of an ExchangePolicy match.
| Name | Number | Description |
|---|
| EXCHANGE_POLICY_ACTION_UNSPECIFIED | 0 | treated as ALLOW |
| EXCHANGE_POLICY_ACTION_ALLOW | 1 | |
| EXCHANGE_POLICY_ACTION_DENY | 2 | |
Top
| Field | Type | Label | Description |
|---|
| exchange_policy_id | string | | |
| Field | Type | Label | Description |
|---|
| exchange_policy_id | string | | |
| Field | Type | Label | Description |
|---|
| name | bool | | Set to true to update the name field. |
| action | bool | | Set to true to update the action field. |
| subject_identity | bool | | Set to true to update the subject_identity field. |
| subject_issuer | bool | | Set to true to update the subject_issuer field. |
| subject_audience | bool | | Set to true to update the subject_audience field. |
| actor_identity | bool | | Set to true to update the actor_identity field. |
| actor_issuer | bool | | Set to true to update the actor_issuer field. |
| client_id | bool | | Set to true to update the client_id field. |
| target_audience | bool | | Set to true to update the target_audience field. |
| outbound_identity | bool | | Set to true to update the outbound_identity field. |
| outbound_scopes | bool | | Set to true to update the outbound_scopes field. |
| outbound_issuer | bool | | Set to true to update the outbound_oauth_as field. |
| external_hooks | bool | | Set to true to update the external hooks field. |
ExchangePolicyService manages exchange policies that govern Credex token
exchanges within a trust zone. Each policy defines conditions on the inbound
token (subject, issuer, actor, client ID, target audience) and determines
whether the exchange is allowed or denied.
Top
This file defines the FederationService gRPC service for managing federations
between trust zones in the Connect control plane. Federations establish trust
relationships that allow workloads in each zone to present their SPIFFE
identities to workloads in the other, enabling secure connectivity across
zone boundaries.
| Field | Type | Label | Description |
|---|
| federation_id | string | optional | |
| Field | Type | Label | Description |
|---|
| federation_id | string | | |
| Field | Type | Label | Description |
|---|
| org_id | string | optional | |
| trust_zone_id | string | optional | |
| remote_trust_zone_id | string | optional | |
FederationService manages federations between trust zones. A federation
establishes a trust relationship that allows workloads in each zone to present
their SPIFFE identities to workloads in the other, enabling secure
connectivity across zone boundaries. Attestation policy bindings control
which workloads can federate.
Top
This file defines the Identity message and related types representing SPIFFE
identities (SVIDs) issued by Connect to workloads on attested nodes. Each
identity records the SPIFFE ID, attestation selectors, and federation
configuration for a workload matched by an attestation policy.
Identity represents a SPIFFE identity (SVID) issued by Connect to a workload
on an attested node. Each identity is derived from a matching attestation
policy and carries the SPIFFE ID, attestation selectors, and optional
federation configuration for the workload.
| Field | Type | Label | Description |
|---|
| id | string | | |
| org_id | string | | |
| trust_zone_id | string | | |
| cluster_id | string | | |
| attestation_policy_id | string | | The attestation policy that matched this workload. |
| ap_binding_id | string | | The attestation policy binding through which this identity was issued. |
| workload_id | string | | The workload to which this identity was issued. |
| spiffe_id | string | | The SPIFFE ID issued to the workload, e.g. spiffe://trust-domain/ns/foo/sa/bar. |
| parent_id | string | | The SPIFFE ID of the SPIRE agent node that attested this workload. |
| selectors | Selector | repeated | Attestation selectors produced by workload attestation plugins (e.g. k8s, unix). |
| dns_names | string | repeated | DNS names to include as DNS Subject Alternative Names (SANs). |
| federations | IdentityFederation | repeated | Federated trust zones or trust domains with which this identity is shared. |
| store_svid | bool | | When true, indicates to SPIRE agents that the x509 SVID should be stored in the svidstore (if the svidstore agent plugin is enabled). |
| created_at | google.protobuf.Timestamp | | |
IdentityFederation specifies a federated trust zone or trust domain with
which an identity is shared, enabling the workload to present its SVID
to workloads in the remote zone.
| Field | Type | Label | Description |
|---|
| trust_zone_id | string | | |
| trust_domain | string | | |
Selector is an attestation selector produced by a workload attestation plugin
(e.g. k8s, unix, docker). Selectors are used to match a workload against
attestation policies to determine which SPIFFE ID to issue.
| Field | Type | Label | Description |
|---|
| type | string | | The attestation plugin type, e.g. “k8s”, “unix”, “docker”. |
| value | string | | The selector value, e.g. “ns:foo”, “user:1000”. |
Top
This file defines the IdentityService gRPC service, which provides read-only
access to SPIFFE identities (SVIDs) issued by Connect. Identities are derived
from attestation policy bindings and record the SPIFFE ID, attestation
selectors, and federation configuration for each attested workload.
| Field | Type | Label | Description |
|---|
| identity_id | string | | |
IdentityService provides read-only access to the SPIFFE identities (SVIDs)
issued by Connect to workloads on attested nodes. Identities are derived from
attestation policy bindings and carry the SPIFFE ID, selectors, and federation
configuration for each workload.
Top
This file defines the Organization message representing the top-level
grouping of resources in the Connect control plane. Trust zones, attestation
policies, and role bindings are all scoped to an organization.
Organization is the top-level grouping of Connect resources. Trust zones,
attestation policies, and role bindings are all scoped to an organization.
Top
This file defines the OrganizationService gRPC service, which provides
read-only access to organizations in the Connect control plane. Organizations
are the top-level grouping of resources: trust zones and attestation policies
are scoped to an organization.
| Field | Type | Label | Description |
|---|
| org_id | string | optional | |
| Field | Type | Label | Description |
|---|
| name | string | optional | |
OrganizationService provides read-only access to organizations. Organizations
are the top-level grouping of Connect resources: trust zones and attestation
policies are scoped to an organization.
Top
This file defines the RoleBinding message and related types used by
Connect’s Role-Based Access Control (RBAC) system. Role bindings associate
a principal (user or group) with a predefined role on a specific resource,
with permissions inherited down the resource hierarchy. RBAC is enforced
server-side.
Group identifies a set of principals by a group claim value in the JWT
presented by users. This allows role bindings to be applied to all members
of a group as managed by the configured identity provider.
| Field | Type | Label | Description |
|---|
| claim_value | string | | For users this is matched against the list of values in the “groups” claim of the JWT presented by a user. |
Resource identifies the target of a role binding. Role bindings can be
applied to System, Organization, Trust Zone, or Cluster resources. Permissions
are inherited down the resource hierarchy from the bound resource.
| Field | Type | Label | Description |
|---|
| type | string | | type can be one of the following: AttestationPolicyBinding AttestationPolicy Cluster FederatedService Federation Organization System TrustZone |
| id | string | | |
RoleBinding associates a principal (user or group) with a role on a specific
resource. Permissions defined by the role are granted on the target resource
and inherited by all child resources in the resource hierarchy. Connect’s
RBAC policies are enforced server-side.
User identifies an individual principal by the “sub” (subject) claim of the
JWT presented by that user to the configured identity provider.
| Field | Type | Label | Description |
|---|
| subject | string | | This is matched against the “sub” claim of the JWT presented by a user. |
Top
This file defines the RoleBindingService gRPC service for managing role
bindings in Connect’s RBAC system. Role bindings associate a principal
(user or group) with a predefined role on a resource, granting permissions
on that resource and all child resources in the hierarchy. Policies are
enforced server-side.
| Field | Type | Label | Description |
|---|
| role_binding_id | string | | |
| Field | Type | Label | Description |
|---|
| role_binding_id | string | | |
| Field | Type | Label | Description |
|---|
| role_id | string | optional | |
| user_subject | string | optional | |
| group_claim_value | string | optional | |
| resource_type | string | optional | |
| resource_id | string | optional | |
RoleBindingService manages role bindings for Connect’s role-based access
control (RBAC) system. Role bindings associate a principal (user or group)
with a predefined role on a specific resource, granting the permissions
defined by that role on the resource and all child resources in the hierarchy.
RBAC policies are enforced server-side.
Top
This file defines the TrustZoneServer message and related types describing
how the SPIRE server managing a trust zone should be deployed. It includes
lifecycle status tracking and configuration for k8s_psat node attestation
when using the Connect datasource with remote clusters.
| Field | Type | Label | Description |
|---|
| audiences | string | repeated | Audiences that can be presented by SPIRE agents in remote clusters to perform node attestation when this server is using the k8s psat plugin with the Connect datasource. At least 1 must be provided if there are remote clusters in the trust zone. |
| spire_server_spiffe_id_path | string | | Path to use for the SPIFFE ID in the JWT presented by the SPIRE server to the cluster’s API server when this server is using the k8s psat plugin with the Connect datasource. This must be configured to be an allowed subject in the remote cluster’s API server. |
TrustZoneServer defines how the server managing a trust zone should be deployed.
| Field | Type | Label | Description |
|---|
| id | string | | The unique ID of the server. Generated by the server. |
| trust_zone_id | string | | Trust Zone managed by this server. Immutable after creation. |
| cluster_id | string | | Cluster in which the server should be deployed. Immutable after creation. |
| kubernetes_namespace | string | | Kubernetes namespace in which the server should be deployed. If not provided the API service should set this. |
| kubernetes_service_account | string | | Name of kubernetes service account to deploy with the server. If not provided the API service should set this. |
| org_id | string | | Organization to which the server belongs. Derived from the trust zone by the API service. |
| helm_values | google.protobuf.Struct | | Helm values to configure the server install with. |
| status | TrustZoneServer.Status | | Current status of the trust zone server |
| created_at | google.protobuf.Timestamp | | Time of resource creation by user. |
| last_updated_at | google.protobuf.Timestamp | | Times of last resource update by user. |
| deleted_at | google.protobuf.Timestamp | | Time of resource deletion by user. |
| connect_k8s_psat_config | ConnectK8sPsatConfig | | Configuration for the k8s psat node attestor plugin when using a Connect datasource with remote clusters. |
Status of a trust zone server
| Name | Number | Description |
|---|
| TRUST_ZONE_SERVER_STATUS_UNSPECIFIED | 0 | |
| TRUST_ZONE_SERVER_STATUS_PROVISIONING | 1 | Provisioning / Deleting statuses are only applicable for managed trust zone servers |
| TRUST_ZONE_SERVER_STATUS_PROVISIONED | 2 | |
| TRUST_ZONE_SERVER_STATUS_PROVISIONING_ERROR | 3 | |
| TRUST_ZONE_SERVER_STATUS_DELETING | 4 | |
| TRUST_ZONE_SERVER_STATUS_DELETED | 5 | |
| TRUST_ZONE_SERVER_STATUS_DELETING_ERROR | 6 | |
Top
This file defines the TrustZoneServerService gRPC service for managing
TrustZoneServers in the Connect control plane. A TrustZoneServer describes
how the SPIRE server for a trust zone should be deployed into a cluster,
including its lifecycle status and node attestation configuration.
| Field | Type | Label | Description |
|---|
| trust_zone_server_id | string | | |
| Field | Type | Label | Description |
|---|
| trust_zone_server_id | string | | |
| Field | Type | Label | Description |
|---|
| helm_values | bool | | Set to true to update helm values of trust zone server to those provided. |
| connect_k8s_psat_config | bool | | Set to true to update configuration of the server k8s PSAT node attestor plugin to the value provided. |
TrustZoneServerService manages TrustZoneServers.
Top
This file defines the TrustZoneService gRPC service for managing trust zones
and handling the registration of agents and SPIRE servers. Trust zones
represent SPIFFE trust domains within the Connect platform; each has its own
root of trust and can federate with other zones.
Agent identifies a Cofide Agent during registration with the trust zone service.
| Field | Type | Label | Description |
|---|
| trust_zone_id | string | optional | |
| Field | Type | Label | Description |
|---|
| trust_zone_id | string | optional | |
| Field | Type | Label | Description |
|---|
| agent_id | string | | |
| Field | Type | Label | Description |
|---|
| trust_zone_server | TrustZoneServer | | To be deprecated, registration of a trust zone server by just specifying the cluster ID Consumers should provide a trust zone server ID instead |
| bundle | spire.api.types.Bundle | | |
| trust_zone_server_id | string | | |
Empty for the moment
TrustZoneServer identifies a SPIRE server by its cluster during registration.
Deprecated: use trust_zone_server_id in RegisterTrustZoneServerRequest instead.
| Field | Type | Label | Description |
|---|
| cluster_id | string | | |
TrustZoneService manages trust zones and handles the registration of agents
and servers. Trust zones represent SPIFFE trust domains within the Connect
platform; each zone has its own root of trust and can federate with other zones.
Top
This file defines the Workload message and related types representing
processes and containers observed by Cofide Observer on attested nodes.
Workload data is streamed to the Connect control plane and used to match
workloads against attestation policies for SPIFFE identity issuance.
KubernetesContainer describes a single container within a Kubernetes pod workload.
KubernetesMetadata contains standard Kubernetes object metadata for a workload.
KubernetesPod contains the runtime details of a Kubernetes pod workload
as observed by the Cofide Observer via the kubelet API.
Observation is a structured data point describing the security posture of
the workload.
Workload represents a process, container, or unit of software running on an
attested node. Workloads are observed by the Cofide Observer and reported to the
Connect control plane. A SPIFFE identity (SVID) can be issued to a workload
if it matches an active attestation policy binding within its trust zone.
WorkloadType enumerates the supported workload runtime types.
| Name | Number | Description |
|---|
| WORKLOAD_TYPE_UNSPECIFIED | 0 | |
| WORKLOAD_TYPE_KUBERNETES_POD | 1 | |
Top
This file defines the WorkloadService gRPC service for accessing workloads
observed by Cofide Observers. Observers stream workload observations from
the kubelet to the Connect control plane, where they are stored and matched
against attestation policies for SPIFFE identity issuance.
WorkloadService provides access to workloads observed by Cofide Observers.
Observers stream workload observations from the kubelet to the Connect control
plane, where they are stored and made available for query. Workloads can be
matched against attestation policies to determine which SPIFFE identity to issue.
| .proto Type | Notes | C++ | Java | Python | Go | C# | PHP | Ruby |
|---|
| double | | double | double | float | float64 | double | float | Float |
| float | | float | float | float | float32 | float | float | Float |
| int32 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint32 instead. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) |
| int64 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint64 instead. | int64 | long | int/long | int64 | long | integer/string | Bignum |
| uint32 | Uses variable-length encoding. | uint32 | int | int/long | uint32 | uint | integer | Bignum or Fixnum (as required) |
| uint64 | Uses variable-length encoding. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum or Fixnum (as required) |
| sint32 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int32s. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) |
| sint64 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int64s. | int64 | long | int/long | int64 | long | integer/string | Bignum |
| fixed32 | Always four bytes. More efficient than uint32 if values are often greater than 2^28. | uint32 | int | int | uint32 | uint | integer | Bignum or Fixnum (as required) |
| fixed64 | Always eight bytes. More efficient than uint64 if values are often greater than 2^56. | uint64 | long | int/long | uint64 | ulong | integer/string | Bignum |
| sfixed32 | Always four bytes. | int32 | int | int | int32 | int | integer | Bignum or Fixnum (as required) |
| sfixed64 | Always eight bytes. | int64 | long | int/long | int64 | long | integer/string | Bignum |
| bool | | bool | boolean | boolean | bool | bool | boolean | TrueClass/FalseClass |
| string | A string must always contain UTF-8 encoded or 7-bit ASCII text. | string | String | str/unicode | string | string | string | String (UTF-8) |
| bytes | May contain any arbitrary sequence of bytes. | string | ByteString | str | []byte | ByteString | string | String (ASCII-8BIT) |
