Cofide Connect API Reference (v0.47.1)

Protocol Documentation

Table of Contents

• proto/agent/v1alpha1/agent.proto

  • Agent

  • AgentStatus

  • AgentStatusCode

• proto/ap_binding/v1alpha1/ap_binding.proto
  • APBinding
  • APBindingFederation
• proto/spire/api/types/selector.proto

  • Selector

  • SelectorMatch

  • SelectorMatch.MatchBehavior

• proto/attestation_policy/v1alpha1/attestation_policy.proto
  • APKubernetes
  • APLabelSelector
  • APLabelSelector.MatchLabelsEntry
  • APMatchExpression
  • APStatic
  • APTPMNode
  • AttestationPolicy
  • TPMAttestation
• proto/trust_provider/v1alpha1/trust_provider.proto

  • K8sPsatConfig

  • K8sPsatConfig.ServiceAccount

  • TrustProvider

  • TrustProviderKind

• proto/cluster/v1alpha1/cluster.proto
  • Cluster
• proto/federation/v1alpha1/federation.proto
  • Federation
• proto/spire/api/types/bundle.proto
  • Bundle
  • BundleMask
  • JWTKey
  • X509Certificate
• proto/trust_zone/v1alpha1/trust_zone.proto

  • TrustZone

  • BundleEndpointProfile

• proto/cofidectl/datasource_plugin/v1alpha2/plugin.proto

  • AddAPBindingRequest

  • AddAPBindingResponse

  • AddAttestationPolicyRequest

  • AddAttestationPolicyResponse

  • AddClusterRequest

  • AddClusterResponse

  • AddFederationRequest

  • AddFederationResponse

  • AddTrustZoneRequest

  • AddTrustZoneResponse

  • DestroyAPBindingRequest

  • DestroyAPBindingResponse

  • DestroyAttestationPolicyRequest

  • DestroyAttestationPolicyResponse

  • DestroyClusterRequest

  • DestroyClusterResponse

  • DestroyFederationRequest

  • DestroyFederationResponse

  • DestroyTrustZoneRequest

  • DestroyTrustZoneResponse

  • GetAttestationPolicyByNameRequest

  • GetAttestationPolicyByNameResponse

  • GetAttestationPolicyRequest

  • GetAttestationPolicyResponse

  • GetClusterByNameRequest

  • GetClusterByNameResponse

  • GetClusterRequest

  • GetClusterResponse

  • GetTrustZoneByNameRequest

  • GetTrustZoneByNameResponse

  • GetTrustZoneRequest

  • GetTrustZoneResponse

  • ListAPBindingsRequest

  • ListAPBindingsRequest.Filter

  • ListAPBindingsResponse

  • ListAttestationPoliciesRequest

  • ListAttestationPoliciesResponse

  • ListClustersRequest

  • ListClustersRequest.Filter

  • ListClustersResponse

  • ListFederationsRequest

  • ListFederationsRequest.Filter

  • ListFederationsResponse

  • ListTrustZonesRequest

  • ListTrustZonesResponse

  • UpdateClusterRequest

  • UpdateClusterResponse

  • UpdateTrustZoneRequest

  • UpdateTrustZoneResponse

  • ValidateRequest

  • ValidateResponse

  • DataSourcePluginService

• proto/cofidectl/provision_plugin/v1alpha2/plugin.proto

  • DeployRequest

  • DeployResponse

  • GetHelmValuesRequest

  • GetHelmValuesResponse

  • Status

  • TearDownRequest

  • TearDownResponse

  • ValidateRequest

  • ValidateResponse

  • ProvisionPluginService

• proto/cofidectl_plugin/v1alpha1/plugin.proto

  • AddAPBindingRequest

  • AddAPBindingResponse

  • AddAttestationPolicyRequest

  • AddAttestationPolicyResponse

  • AddClusterRequest

  • AddClusterResponse

  • AddFederationRequest

  • AddFederationResponse

  • AddTrustZoneRequest

  • AddTrustZoneResponse

  • DestroyAPBindingRequest

  • DestroyAPBindingResponse

  • DestroyAttestationPolicyRequest

  • DestroyAttestationPolicyResponse

  • DestroyClusterRequest

  • DestroyClusterResponse

  • DestroyFederationRequest

  • DestroyFederationResponse

  • DestroyTrustZoneRequest

  • DestroyTrustZoneResponse

  • GetAttestationPolicyRequest

  • GetAttestationPolicyResponse

  • GetClusterRequest

  • GetClusterResponse

  • GetTrustZoneRequest

  • GetTrustZoneResponse

  • ListAPBindingsRequest

  • ListAPBindingsRequest.Filter

  • ListAPBindingsResponse

  • ListAttestationPoliciesRequest

  • ListAttestationPoliciesResponse

  • ListClustersRequest

  • ListClustersResponse

  • ListFederationsByTrustZoneRequest

  • ListFederationsByTrustZoneResponse

  • ListFederationsRequest

  • ListFederationsResponse

  • ListTrustZonesRequest

  • ListTrustZonesResponse

  • UpdateClusterRequest

  • UpdateClusterResponse

  • UpdateTrustZoneRequest

  • UpdateTrustZoneResponse

  • ValidateRequest

  • ValidateResponse

  • DataSourcePluginService

• proto/plugins/v1alpha1/plugins.proto
  • Plugins
• proto/config/v1alpha1/config.proto
  • Config
  • Config.PluginConfigEntry
• proto/federated_service/v1alpha1/federated_service.proto

  • FederatedService

  • FederatedService.WorkloadLabelsEntry

  • GatewayEntry

  • GatewaySpec

  • TLSMode

• proto/connect/agent_service/v1alpha1/agent_service.proto

  • CreateAgentJoinTokenRequest

  • CreateAgentJoinTokenResponse

  • DeregisterFederatedServiceRequest

  • DeregisterFederatedServiceResponse

  • GetFederatedServiceRequest

  • GetFederatedServiceResponse

  • ListFederatedServicesRequest

  • ListFederatedServicesResponse

  • RegisterFederatedServiceRequest

  • RegisterFederatedServiceResponse

  • UpdateAgentStatusRequest

  • UpdateAgentStatusResponse

  • UpdateFederatedServiceRequest

  • UpdateFederatedServiceResponse

  • AgentService

• proto/connect/ap_binding_service/v1alpha1/ap_binding_service.proto

  • CreateAPBindingRequest

  • CreateAPBindingResponse

  • DestroyAPBindingRequest

  • DestroyAPBindingResponse

  • GetAPBindingRequest

  • GetAPBindingResponse

  • ListAPBindingsRequest

  • ListAPBindingsRequest.Filter

  • ListAPBindingsResponse

  • UpdateAPBindingRequest

  • UpdateAPBindingResponse

  • APBindingService

• proto/connect/attestation_policy_service/v1alpha1/attestation_policy_service.proto

  • CreateAttestationPolicyRequest

  • CreateAttestationPolicyResponse

  • DestroyAttestationPolicyRequest

  • DestroyAttestationPolicyResponse

  • GetAttestationPolicyRequest

  • GetAttestationPolicyResponse

  • ListAttestationPoliciesRequest

  • ListAttestationPoliciesRequest.Filter

  • ListAttestationPoliciesRequest.TPMNodeFilter

  • ListAttestationPoliciesResponse

  • UpdateAttestationPolicyRequest

  • UpdateAttestationPolicyResponse

  • AttestationPolicyKind

  • AttestationPolicyService

• proto/connect/cluster_service/v1alpha1/cluster_service.proto

  • CreateClusterRequest

  • CreateClusterResponse

  • DestroyClusterRequest

  • DestroyClusterResponse

  • GetClusterRequest

  • GetClusterResponse

  • ListClustersRequest

  • ListClustersRequest.Filter

  • ListClustersResponse

  • UpdateClusterRequest

  • UpdateClusterResponse

  • ClusterService

• proto/connect/datastore_service/v1alpha1/datastore.proto
  • AttestedNode
  • Selector
  • Selectors
• proto/connect/datastore_service/v1alpha1/datastore_service.proto

  • AttestedNodeMask

  • CountAttestedNodesRequest

  • CountAttestedNodesResponse

  • CreateAttestedNodeRequest

  • CreateAttestedNodeResponse

  • DeleteAttestedNodeRequest

  • DeleteAttestedNodeResponse

  • FetchAttestedNodeRequest

  • FetchAttestedNodeResponse

  • GetNodeSelectorsRequest

  • GetNodeSelectorsResponse

  • ListAttestedNodesRequest

  • ListAttestedNodesRequest.BySelectors

  • ListAttestedNodesResponse

  • ListNodeSelectorsRequest

  • ListNodeSelectorsResponse

  • ListNodeSelectorsResponse.NodeSelectors

  • ListNodeSelectorsResponse.SelectorsEntry

  • PruneAttestedExpiredNodesRequest

  • PruneAttestedExpiredNodesResponse

  • SetNodeSelectorsRequest

  • SetNodeSelectorsResponse

  • UpdateAttestedNodeRequest

  • UpdateAttestedNodeResponse

  • ListAttestedNodesRequest.MatchBehavior

  • DataStoreService

• proto/exchange_policy/v1alpha1/exchange_policy.proto

  • ExchangePolicy

  • StringMatcher

  • StringSet

  • ExchangePolicyAction

• proto/connect/exchange_policy_service/v1alpha1/exchange_policy_service.proto

  • CreateExchangePolicyRequest

  • CreateExchangePolicyResponse

  • DestroyExchangePolicyRequest

  • DestroyExchangePolicyResponse

  • GetExchangePolicyRequest

  • GetExchangePolicyResponse

  • ListExchangePoliciesRequest

  • ListExchangePoliciesRequest.Filter

  • ListExchangePoliciesResponse

  • UpdateExchangePolicyRequest

  • UpdateExchangePolicyRequest.UpdateMask

  • UpdateExchangePolicyResponse

  • ExchangePolicyService

• proto/connect/federation_service/v1alpha1/federation_service.proto

  • CreateFederationRequest

  • CreateFederationResponse

  • DestroyFederationRequest

  • DestroyFederationResponse

  • GetFederationRequest

  • GetFederationResponse

  • ListFederationsRequest

  • ListFederationsRequest.Filter

  • ListFederationsResponse

  • FederationService

• proto/identity/v1alpha1/identity.proto
  • Identity
  • IdentityFederation
  • Selector
• proto/connect/identity_service/v1alpha1/identity_service.proto

  • GetIdentityRequest

  • GetIdentityResponse

  • ListIdentitiesRequest

  • ListIdentitiesRequest.Filter

  • ListIdentitiesResponse

  • IdentityService

• proto/organization/v1alpha1/organization.proto
  • Organization
• proto/connect/organization_service/v1alpha1/organization_service.proto

  • GetOrganizationRequest

  • GetOrganizationResponse

  • ListOrganizationsRequest

  • ListOrganizationsRequest.Filter

  • ListOrganizationsResponse

  • OrganizationService

• proto/role_binding/v1alpha1/role_binding.proto
  • Group
  • Resource
  • RoleBinding
  • User
• proto/connect/role_binding_service/v1alpha1/role_binding_service.proto

  • CreateRoleBindingRequest

  • CreateRoleBindingResponse

  • DestroyRoleBindingRequest

  • DestroyRoleBindingResponse

  • GetRoleBindingRequest

  • GetRoleBindingResponse

  • ListRoleBindingsRequest

  • ListRoleBindingsRequest.Filter

  • ListRoleBindingsResponse

  • UpdateRoleBindingRequest

  • UpdateRoleBindingResponse

  • RoleBindingService

• proto/trust_zone_server/v1alpha1/trust_zone_server.proto

  • ConnectK8sPsatConfig

  • TrustZoneServer

  • TrustZoneServer.Status

  • TrustZoneServerStatus

• proto/connect/trust_zone_server_service/v1alpha1/trust_zone_server_service.proto

  • CreateTrustZoneServerRequest

  • CreateTrustZoneServerResponse

  • DestroyTrustZoneServerRequest

  • DestroyTrustZoneServerResponse

  • GetTrustZoneServerRequest

  • GetTrustZoneServerResponse

  • ListTrustZoneServersRequest

  • ListTrustZoneServersRequest.Filter

  • ListTrustZoneServersResponse

  • UpdateTrustZoneServerRequest

  • UpdateTrustZoneServerRequest.UpdateMask

  • UpdateTrustZoneServerResponse

  • UpdateTrustZoneServerStatusRequest

  • UpdateTrustZoneServerStatusResponse

  • TrustZoneServerService

• proto/connect/trust_zone_service/v1alpha1/trust_zone_service.proto

  • Agent

  • CreateTrustZoneRequest

  • CreateTrustZoneResponse

  • DestroyTrustZoneRequest

  • DestroyTrustZoneResponse

  • GetTrustZoneRequest

  • GetTrustZoneResponse

  • ListTrustZonesRequest

  • ListTrustZonesRequest.Filter

  • ListTrustZonesResponse

  • RegisterAgentRequest

  • RegisterAgentResponse

  • RegisterTrustZoneServerRequest

  • RegisterTrustZoneServerResponse

  • TrustZoneServer

  • UpdateTrustZoneBundleRequest

  • UpdateTrustZoneBundleResponse

  • UpdateTrustZoneRequest

  • UpdateTrustZoneResponse

  • TrustZoneService

• proto/workload/v1alpha1/workload.proto

  • KubernetesContainer

  • KubernetesMetadata

  • KubernetesMetadata.AnnotationsEntry

  • KubernetesMetadata.LabelsEntry

  • KubernetesPod

  • Observation

  • Workload

  • WorkloadType

• proto/connect/workload_service/v1alpha1/workload_service.proto

  • ListWorkloadsRequest

  • ListWorkloadsRequest.Filter

  • ListWorkloadsResponse

  • PublishWorkloadsRequest

  • PublishWorkloadsResponse

  • WorkloadService

• proto/provision_plugin/v1alpha1/plugin.proto

  • DeployRequest

  • DeployResponse

  • GetHelmValuesRequest

  • GetHelmValuesResponse

  • Status

  • TearDownRequest

  • TearDownResponse

  • ValidateRequest

  • ValidateResponse

  • ProvisionPluginService

• Scalar Value Types

Top

proto/agent/v1alpha1/agent.proto

This file defines the Agent message and related types representing Cofide Agents deployed in clusters registered with the Connect control plane.

Agent

Agent represents a Cofide Agent deployed in a cluster. The agent facilitates cluster registration with the Connect control plane and provides dynamic control plane functionality including federated service management.

Field	Type	Label	Description
id	string	optional
cluster_id	string	optional
trust_zone_id	string	optional

AgentStatus

AgentStatus reports the current operational status of a Cofide Agent.

Field	Type	Label	Description
status	AgentStatusCode	optional
status_message	string	optional
last_updated	int64	optional	Unix timestamp (seconds) of the last status update.

AgentStatusCode

AgentStatusCode enumerates the possible operational states of a Cofide Agent.

Name	Number	Description
AGENT_STATUS_CODE_UNSPECIFIED	0
AGENT_STATUS_CODE_RUNNING	1
AGENT_STATUS_CODE_STOPPED	2
AGENT_STATUS_CODE_ERROR	3
AGENT_STATUS_CODE_STARTING	4

Top

proto/ap_binding/v1alpha1/ap_binding.proto

This file defines the APBinding message and related types representing attestation policy bindings in the Connect control plane. An APBinding associates an attestation policy with a trust zone, enabling identity issuance for matching workloads within that zone.

APBinding

APBinding binds an attestation policy to a trust zone, enabling Connect to issue SPIFFE identities to workloads that match the policy within that zone. Optionally, federations can be specified to restrict which federated trust zones will be visible to matching workloads, allowing the same policy to be re-used across multiple trust zones.

Field	Type	Label	Description
id	string	optional
org_id	string	optional
trust_zone_id	string	optional
policy_id	string	optional
federations	APBindingFederation	repeated	The federated trust zones which will be visible to workloads matching the policy in this binding.

APBindingFederation

APBindingFederation identifies a trust zone that is included in the federated scope of an attestation policy binding.

Field	Type	Label	Description
trust_zone_id	string	optional

Top

proto/spire/api/types/selector.proto

Selector

Field	Type	Label	Description
type	string		The type of the selector. This is typically the name of the plugin that produces the selector.
value	string		The value of the selector.

SelectorMatch

Field	Type	Label	Description
selectors	Selector	repeated	The set of selectors to match on.
match	SelectorMatch.MatchBehavior		How to match the selectors.

SelectorMatch.MatchBehavior

Name	Number	Description
MATCH_BEHAVIOR_EXACT_UNSPECIFIED	0	Indicates that the selectors in this match are equal to the candidate selectors, independent of ordering. Example: Given: - ‘e1 { Selectors: [“a:1”, “b:2”, “c:3”]}’ - ‘e2 { Selectors: [“a:1”, “b:2”]}’ - ‘e3 { Selectors: [“a:1”]}’ Operation: - MATCH_EXACT [“a:1”, “b:2”] Entries that match: - ‘e2’
MATCH_BEHAVIOR_SUBSET	1	Indicates that all candidates which have a non-empty subset of the provided set of selectors will match. Example: Given: - ‘e1 { Selectors: [“a:1”, “b:2”, “c:3”]}’ - ‘e2 { Selectors: [“a:1”, “b:2”]}’ - ‘e3 { Selectors: [“a:1”]}’ Operation: - MATCH_SUBSET [“a:1”] Entries that match: - ‘e1’
MATCH_BEHAVIOR_SUPERSET	2	Indicates that all candidates which are a superset of the provided selectors will match. Example: Given: - ‘e1 { Selectors: [“a:1”, “b:2”, “c:3”]}’ - ‘e2 { Selectors: [“a:1”, “b:2”]}’ - ‘e3 { Selectors: [“a:1”]}’ Operation: - MATCH_SUPERSET [“a:1”, “b:2”] Entries that match: - ‘e1’ - ‘e2’
MATCH_BEHAVIOR_ANY	3	Indicates that all candidates which have at least one of the provided set of selectors will match. Example: Given: - ‘e1 { Selectors: [“a:1”, “b:2”, “c:3”]}’ - ‘e2 { Selectors: [“a:1”, “b:2”]}’ - ‘e3 { Selectors: [“a:1”]}’ Operation: - MATCH_ANY [“a:1”] Entries that match: - ‘e1’ - ‘e2’ - ‘e3’

Top

proto/attestation_policy/v1alpha1/attestation_policy.proto

This file defines the AttestationPolicy message and related types used to specify the criteria for issuing SPIFFE identities to workloads. Supported policy types cover Kubernetes workload attestation (APKubernetes), static attestation (APStatic), and TPM-based node attestation (APTPMNode).

APKubernetes

APKubernetes represents a Kubernetes attestation policy. Identities are managed dynamically in the control plane based on workload observations.

Field	Type	Label	Description
namespace_selector	APLabelSelector	optional
pod_selector	APLabelSelector	optional
dns_name_templates	string	repeated
spiffe_id_path_template	string	optional	Custom SPIFFE ID path format for Connect identity issuance This defines the identity path appended to domain of the trust zone it is bound to

An example spiffe_id_path_template and corresponding SPIFFE ID: ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }} => spiffe://<trust_domain_of_trust_zone>/ns/…/sa/…

This is supported in both Connect and OSS SPIRE via spire-controller-manager Note that the supported templates are a subset of those in the SCM

Valid template components: {{ .ClusterName }} - Name of cluster {{ .PodMeta.Namespace }} - Namespace of the pod {{ index .PodMeta.Labels “key” }} - Pod label value of a provided key {{ index .PodMeta.Annotations “key” }} - Pod annotation value of a provided key {{ .PodSpec.ServiceAccountName }} - Service account of the pod |

APLabelSelector

This definition has been adapted from the LabelSelector message in Kubernetes. https://github.com/kubernetes/apimachinery/blob/master/pkg/apis/meta/v1/generated.proto

Field	Type	Label	Description
match_labels	APLabelSelector.MatchLabelsEntry	repeated
match_expressions	APMatchExpression	repeated

APLabelSelector.MatchLabelsEntry

Field	Type	Label	Description
key	string
value	string

APMatchExpression

APMatchExpression represents a single label requirement using a key, operator, and set of values. Follows the Kubernetes LabelSelectorRequirement semantics.

Field	Type	Label	Description
key	string
operator	string
values	string	repeated

APStatic

APStatic represents a static attestation policy No observations are required before identities can be issued to matching workloads.

Field	Type	Label	Description
spiffe_id	string	optional	Deprecated.
spiffe_id_path	string	optional
parent_id_path	string	optional
selectors	spire.api.types.Selector	repeated
dns_names	string	repeated

APTPMNode

APTPMNode represents a node (agent) attesting using a Trusted Platform Module (TPM).

Field	Type	Label	Description
attestation	TPMAttestation
selector_values	string	repeated	selector_values are the values of node selectors to use for this node. The key of the selectors will be “tpm”.

AttestationPolicy

AttestationPolicy defines criteria used to issue a SPIFFE identity to a workload. Policies specify attributes of the workload that must be attested before an identity (SVID) is issued. Policies are bound to trust zones via APBindings and support Kubernetes, static, and TPM node attestation methods.

Field	Type	Label	Description
id	string	optional
name	string
org_id	string	optional
kubernetes	APKubernetes
static	APStatic
tpm_node	APTPMNode

TPMAttestation

TPMAttestation represents attestation requirements for a node (agent) attesting using a Trusted Platform Module (TPM).

Field	Type	Label	Description
ek_hash	string	optional	ek_hash is the SHA256 hash of the TPM’s Endorsement Key (EK).

Top

proto/trust_provider/v1alpha1/trust_provider.proto

K8sPsatConfig

Field	Type	Label	Description
enabled	bool		Whether to enable the k8s psat node attestor plugin with a Connect datasource.
allowed_service_accounts	K8sPsatConfig.ServiceAccount	repeated	Namespace and name of service accounts agents can use tokens from to attest nodes in this cluster. At least 1 must be provided if the SPIRE server is outside the cluster.
allowed_node_label_keys	string	repeated	Node labels that can be used as selectors in this cluster.
allowed_pod_label_keys	string	repeated	Pod labels that can be used as selectors in this cluster.
api_server_ca_cert	bytes		CA certificate of the cluster’s API server. Optional, but required if the SPIRE server is outside the cluster and the cluster’s API server CA is not already trusted by the SPIRE server (very likely).
api_server_url	string		Cluster’s API server URL. Required if the SPIRE server is outside the cluster.
api_server_tls_server_name	string		Alternative TLS server name to verify the presented certificate with if the hostname of the API server URL is not in the presented certificate.
api_server_proxy_url	string		Proxy URL of the API server (if running behind a proxy).
spire_server_audience	string		Audience the SPIRE server should use in the JWT presented to the cluster’s API server. Required if the SPIRE server is outside the cluster.

K8sPsatConfig.ServiceAccount

Field	Type	Label	Description
namespace	string
service_account_name	string

TrustProvider

Field	Type	Label	Description
kind	string	optional
k8s_psat_config	K8sPsatConfig		Configuration for the k8s psat node attestor plugin when using a Connect datasource with remote clusters.

Configuration for additional server plugins goes here. More than one may be enabled, to allow node attestation in a cluster to be done in multiple different ways. |

TrustProviderKind

Name	Number	Description
TRUST_PROVIDER_KIND_UNSPECIFIED	0
TRUST_PROVIDER_KIND_KUBERNETES	1

Top

proto/cluster/v1alpha1/cluster.proto

This file defines the Cluster message representing a single environment (e.g. a Kubernetes cluster) onboarded onto the Connect control plane.

Cluster

Cluster represents a single environment (e.g. a Kubernetes cluster) onboarded onto Connect. Each cluster belongs to a trust zone.

Field	Type	Label	Description
id	string	optional
name	string	optional
org_id	string	optional
trust_zone_id	string	optional
kubernetes_context	string	optional	The kubeconfig context name used to interact with this cluster.
trust_provider	proto.trust_provider.v1alpha1.TrustProvider	optional	The node attestation trust provider configuration for this cluster.
extra_helm_values	google.protobuf.Struct	optional	Additional Helm values to pass to the Cofide SPIRE chart deployment.
profile	string	optional
external_server	bool	optional	Whether the SPIRE server for this cluster’s trust zone is deployed externally (i.e. not within this cluster).
oidc_issuer_url	string	optional	OIDC issuer URL for the Kubernetes API server, used for k8s_psat node attestation.
oidc_issuer_ca_cert	bytes	optional	PEM-encoded CA certificate for the OIDC issuer, if it uses a private CA.

Top

proto/federation/v1alpha1/federation.proto

This file defines the Federation message representing a trust relationship between two trust zones in the Connect control plane. Federations allow workloads in each zone to present their SPIFFE identities to workloads in the other, enabling secure communication across zone boundaries.

Federation

Federation represents a trust relationship between two trust zones. It allows workloads in each zone to establish secure connections with workloads in the other, while keeping each zone’s root of trust securely isolated. Attestation policies on AP bindings determine which workloads are permitted to federate.

Field	Type	Label	Description
id	string	optional
org_id	string	optional
trust_zone_id	string	optional	The local trust zone that initiates the federation.
remote_trust_zone_id	string	optional	The remote trust zone that this federation points to.

Top

proto/spire/api/types/bundle.proto

Bundle

Field	Type	Label	Description
trust_domain	string		The name of the trust domain the bundle belongs to (e.g., “example.org”).
x509_authorities	X509Certificate	repeated	X.509 authorities for authenticating X509-SVIDs.
jwt_authorities	JWTKey	repeated	JWT authorities for authenticating JWT-SVIDs.
refresh_hint	int64		A hint on how often the bundle should be refreshed from the bundle provider, in seconds. Can be zero (meaning no hint available).
sequence_number	uint64		The sequence number of the bundle.

BundleMask

Field	Type	Label	Description
x509_authorities	bool		x509_authorities field mask.
jwt_authorities	bool		jwt_authorities field mask.
refresh_hint	bool		refresh_hint field mask.
sequence_number	bool		sequence_number field mask.

JWTKey

Field	Type	Label	Description
public_key	bytes		The PKIX encoded public key.
key_id	string		The key identifier.
expires_at	int64		When the key expires (seconds since Unix epoch). If zero, the key does not expire.
tainted	bool		This authority is no longer secure and must not be used

X509Certificate

Field	Type	Label	Description
asn1	bytes		The ASN.1 DER encoded bytes of the X.509 certificate.
tainted	bool		This authority is no longer secure and must not be used.

Top

proto/trust_zone/v1alpha1/trust_zone.proto

This file defines the TrustZone message and related types representing a SPIFFE trust domain within the Connect control plane. A trust zone encompasses one or more clusters and/or nodes within a single trust boundary and can federate with other trust zones to enable secure cross-zone connectivity.

TrustZone

TrustZone represents one or more clusters and/or nodes within a single trust boundary. Each trust zone is a SPIFFE trust domain: workload identities (SVIDs) issued within the zone carry the trust domain as the root of their SPIFFE ID. Federations can be created between trust zones to allow selected workloads to establish secure connectivity across zone boundaries.

Field	Type	Label	Description
name	string
trust_domain	string		The SPIFFE trust domain for this zone, e.g. “example.com”.
bundle_endpoint_url	string	optional	URL of the SPIFFE bundle endpoint, used by remote trust zones to fetch this zone’s trust bundle for federation.
bundle	spire.api.types.Bundle	optional	The current SPIRE trust bundle for this zone, containing the root CA certificates.
jwt_issuer	string	optional	JWT issuer URL for SVIDs issued within this trust zone.
bundle_endpoint_profile	BundleEndpointProfile	optional	The SPIFFE federation profile used to serve and consume trust bundles.
id	string	optional
is_management_zone	bool		Whether this trust zone hosts the Connect management plane.
org_id	string	optional

BundleEndpointProfile

BundleEndpointProfile specifies the SPIFFE federation profile used to serve and consume trust bundles for a trust zone.

Name	Number	Description
BUNDLE_ENDPOINT_PROFILE_UNSPECIFIED	0
BUNDLE_ENDPOINT_PROFILE_HTTPS_SPIFFE	1	SPIFFE-authenticated bundle endpoint.
BUNDLE_ENDPOINT_PROFILE_HTTPS_WEB	2	Web PKI-authenticated bundle endpoint.

Top

proto/cofidectl/datasource_plugin/v1alpha2/plugin.proto

AddAPBindingRequest

Field	Type	Label	Description
binding	proto.ap_binding.v1alpha1.APBinding	optional

AddAPBindingResponse

Field	Type	Label	Description
binding	proto.ap_binding.v1alpha1.APBinding	optional

AddAttestationPolicyRequest

Field	Type	Label	Description
policy	proto.attestation_policy.v1alpha1.AttestationPolicy	optional

AddAttestationPolicyResponse

Field	Type	Label	Description
policy	proto.attestation_policy.v1alpha1.AttestationPolicy	optional

AddClusterRequest

Field	Type	Label	Description
cluster	proto.cluster.v1alpha1.Cluster	optional

AddClusterResponse

Field	Type	Label	Description
cluster	proto.cluster.v1alpha1.Cluster	optional

AddFederationRequest

Field	Type	Label	Description
federation	proto.federation.v1alpha1.Federation	optional

AddFederationResponse

Field	Type	Label	Description
federation	proto.federation.v1alpha1.Federation	optional

AddTrustZoneRequest

Field	Type	Label	Description
trust_zone	proto.trust_zone.v1alpha1.TrustZone	optional

AddTrustZoneResponse

Field	Type	Label	Description
trust_zone	proto.trust_zone.v1alpha1.TrustZone	optional

DestroyAPBindingRequest

Field	Type	Label	Description
id	string	optional

DestroyAPBindingResponse

DestroyAttestationPolicyRequest

Field	Type	Label	Description
id	string	optional

DestroyAttestationPolicyResponse

DestroyClusterRequest

Field	Type	Label	Description
id	string	optional

DestroyClusterResponse

DestroyFederationRequest

Field	Type	Label	Description
id	string	optional

DestroyFederationResponse

DestroyTrustZoneRequest

Field	Type	Label	Description
id	string	optional

DestroyTrustZoneResponse

GetAttestationPolicyByNameRequest

Field	Type	Label	Description
name	string	optional

GetAttestationPolicyByNameResponse

Field	Type	Label	Description
policy	proto.attestation_policy.v1alpha1.AttestationPolicy

GetAttestationPolicyRequest

Field	Type	Label	Description
id	string	optional

GetAttestationPolicyResponse

Field	Type	Label	Description
policy	proto.attestation_policy.v1alpha1.AttestationPolicy

GetClusterByNameRequest

Field	Type	Label	Description
name	string	optional
trust_zone_id	string	optional

GetClusterByNameResponse

Field	Type	Label	Description
cluster	proto.cluster.v1alpha1.Cluster	optional

GetClusterRequest

Field	Type	Label	Description
id	string	optional

GetClusterResponse

Field	Type	Label	Description
cluster	proto.cluster.v1alpha1.Cluster	optional

GetTrustZoneByNameRequest

Field	Type	Label	Description
name	string	optional

GetTrustZoneByNameResponse

Field	Type	Label	Description
trust_zone	proto.trust_zone.v1alpha1.TrustZone	optional

GetTrustZoneRequest

Field	Type	Label	Description
id	string	optional

GetTrustZoneResponse

Field	Type	Label	Description
trust_zone	proto.trust_zone.v1alpha1.TrustZone	optional

ListAPBindingsRequest

Field	Type	Label	Description
filter	ListAPBindingsRequest.Filter	optional

ListAPBindingsRequest.Filter

Field	Type	Label	Description
trust_zone_id	string	optional
policy_id	string	optional

ListAPBindingsResponse

Field	Type	Label	Description
bindings	proto.ap_binding.v1alpha1.APBinding	repeated

ListAttestationPoliciesRequest

ListAttestationPoliciesResponse

Field	Type	Label	Description
policies	proto.attestation_policy.v1alpha1.AttestationPolicy	repeated

ListClustersRequest

Field	Type	Label	Description
filter	ListClustersRequest.Filter	optional

ListClustersRequest.Filter

Field	Type	Label	Description
trust_zone_id	string	optional

ListClustersResponse

Field	Type	Label	Description
clusters	proto.cluster.v1alpha1.Cluster	repeated

ListFederationsRequest

Field	Type	Label	Description
filter	ListFederationsRequest.Filter	optional

ListFederationsRequest.Filter

Field	Type	Label	Description
trust_zone_id	string	optional

ListFederationsResponse

Field	Type	Label	Description
federations	proto.federation.v1alpha1.Federation	repeated

ListTrustZonesRequest

ListTrustZonesResponse

Field	Type	Label	Description
trust_zones	proto.trust_zone.v1alpha1.TrustZone	repeated

UpdateClusterRequest

Field	Type	Label	Description
cluster	proto.cluster.v1alpha1.Cluster	optional

UpdateClusterResponse

Field	Type	Label	Description
cluster	proto.cluster.v1alpha1.Cluster	optional

UpdateTrustZoneRequest

Field	Type	Label	Description
trust_zone	proto.trust_zone.v1alpha1.TrustZone	optional

UpdateTrustZoneResponse

Field	Type	Label	Description
trust_zone	proto.trust_zone.v1alpha1.TrustZone	optional

ValidateRequest

ValidateResponse

DataSourcePluginService

Method Name	Request Type	Response Type	Description
Validate	ValidateRequest	ValidateResponse
AddTrustZone	AddTrustZoneRequest	AddTrustZoneResponse
DestroyTrustZone	DestroyTrustZoneRequest	DestroyTrustZoneResponse
GetTrustZone	GetTrustZoneRequest	GetTrustZoneResponse
GetTrustZoneByName	GetTrustZoneByNameRequest	GetTrustZoneByNameResponse
ListTrustZones	ListTrustZonesRequest	ListTrustZonesResponse
UpdateTrustZone	UpdateTrustZoneRequest	UpdateTrustZoneResponse
AddCluster	AddClusterRequest	AddClusterResponse
DestroyCluster	DestroyClusterRequest	DestroyClusterResponse
GetCluster	GetClusterRequest	GetClusterResponse
GetClusterByName	GetClusterByNameRequest	GetClusterByNameResponse
ListClusters	ListClustersRequest	ListClustersResponse
UpdateCluster	UpdateClusterRequest	UpdateClusterResponse
AddAttestationPolicy	AddAttestationPolicyRequest	AddAttestationPolicyResponse
DestroyAttestationPolicy	DestroyAttestationPolicyRequest	DestroyAttestationPolicyResponse
GetAttestationPolicy	GetAttestationPolicyRequest	GetAttestationPolicyResponse
GetAttestationPolicyByName	GetAttestationPolicyByNameRequest	GetAttestationPolicyByNameResponse
ListAttestationPolicies	ListAttestationPoliciesRequest	ListAttestationPoliciesResponse
AddAPBinding	AddAPBindingRequest	AddAPBindingResponse
DestroyAPBinding	DestroyAPBindingRequest	DestroyAPBindingResponse
ListAPBindings	ListAPBindingsRequest	ListAPBindingsResponse
AddFederation	AddFederationRequest	AddFederationResponse
DestroyFederation	DestroyFederationRequest	DestroyFederationResponse
ListFederations	ListFederationsRequest	ListFederationsResponse

Top

proto/cofidectl/provision_plugin/v1alpha2/plugin.proto

DeployRequest

Field	Type	Label	Description
data_source	uint32	optional
kube_cfg_file	string	optional
trust_zone_ids	string	repeated

DeployResponse

Field	Type	Label	Description
status	Status	optional

GetHelmValuesRequest

Field	Type	Label	Description
data_source	uint32	optional
cluster_id	string	optional

GetHelmValuesResponse

Field	Type	Label	Description
helm_values	google.protobuf.Struct	optional

Status

Field	Type	Label	Description
stage	string	optional
message	string	optional
done	bool	optional
error	string	optional

TearDownRequest

Field	Type	Label	Description
data_source	uint32	optional
kube_cfg_file	string	optional
trust_zone_ids	string	repeated

TearDownResponse

Field	Type	Label	Description
status	Status	optional

ValidateRequest

ValidateResponse

ProvisionPluginService

Method Name	Request Type	Response Type	Description
Validate	ValidateRequest	ValidateResponse
Deploy	DeployRequest	DeployResponse stream
TearDown	TearDownRequest	TearDownResponse stream
GetHelmValues	GetHelmValuesRequest	GetHelmValuesResponse

Top

proto/cofidectl_plugin/v1alpha1/plugin.proto

AddAPBindingRequest

Field	Type	Label	Description
binding	proto.ap_binding.v1alpha1.APBinding	optional

AddAPBindingResponse

Field	Type	Label	Description
binding	proto.ap_binding.v1alpha1.APBinding	optional

AddAttestationPolicyRequest

Field	Type	Label	Description
policy	proto.attestation_policy.v1alpha1.AttestationPolicy	optional

AddAttestationPolicyResponse

Field	Type	Label	Description
policy	proto.attestation_policy.v1alpha1.AttestationPolicy	optional

AddClusterRequest

Field	Type	Label	Description
cluster	proto.cluster.v1alpha1.Cluster	optional

AddClusterResponse

Field	Type	Label	Description
cluster	proto.cluster.v1alpha1.Cluster	optional

AddFederationRequest

Field	Type	Label	Description
federation	proto.federation.v1alpha1.Federation	optional

AddFederationResponse

Field	Type	Label	Description
federation	proto.federation.v1alpha1.Federation	optional

AddTrustZoneRequest

Field	Type	Label	Description
trust_zone	proto.trust_zone.v1alpha1.TrustZone	optional

AddTrustZoneResponse

Field	Type	Label	Description
trust_zone	proto.trust_zone.v1alpha1.TrustZone	optional

DestroyAPBindingRequest

Field	Type	Label	Description
binding	proto.ap_binding.v1alpha1.APBinding	optional

DestroyAPBindingResponse

DestroyAttestationPolicyRequest

Field	Type	Label	Description
name	string	optional

DestroyAttestationPolicyResponse

DestroyClusterRequest

Field	Type	Label	Description
name	string	optional
trust_zone	string	optional

DestroyClusterResponse

DestroyFederationRequest

Field	Type	Label	Description
federation	proto.federation.v1alpha1.Federation	optional

DestroyFederationResponse

DestroyTrustZoneRequest

Field	Type	Label	Description
name	string	optional

DestroyTrustZoneResponse

GetAttestationPolicyRequest

Field	Type	Label	Description
name	string	optional

GetAttestationPolicyResponse

Field	Type	Label	Description
policy	proto.attestation_policy.v1alpha1.AttestationPolicy

GetClusterRequest

Field	Type	Label	Description
name	string	optional
trust_zone	string	optional

GetClusterResponse

Field	Type	Label	Description
cluster	proto.cluster.v1alpha1.Cluster	optional

GetTrustZoneRequest

Field	Type	Label	Description
name	string	optional

GetTrustZoneResponse

Field	Type	Label	Description
trust_zone	proto.trust_zone.v1alpha1.TrustZone	optional

ListAPBindingsRequest

Field	Type	Label	Description
filter	ListAPBindingsRequest.Filter	optional

ListAPBindingsRequest.Filter

Field	Type	Label	Description
trust_zone_name	string	optional
policy_name	string	optional

ListAPBindingsResponse

Field	Type	Label	Description
bindings	proto.ap_binding.v1alpha1.APBinding	repeated

ListAttestationPoliciesRequest

ListAttestationPoliciesResponse

Field	Type	Label	Description
policies	proto.attestation_policy.v1alpha1.AttestationPolicy	repeated

ListClustersRequest

Field	Type	Label	Description
trust_zone	string	optional

ListClustersResponse

Field	Type	Label	Description
clusters	proto.cluster.v1alpha1.Cluster	repeated

ListFederationsByTrustZoneRequest

Field	Type	Label	Description
trust_zone_name	string	optional

ListFederationsByTrustZoneResponse

Field	Type	Label	Description
federations	proto.federation.v1alpha1.Federation	repeated

ListFederationsRequest

ListFederationsResponse

Field	Type	Label	Description
federations	proto.federation.v1alpha1.Federation	repeated

ListTrustZonesRequest

ListTrustZonesResponse

Field	Type	Label	Description
trust_zones	proto.trust_zone.v1alpha1.TrustZone	repeated

UpdateClusterRequest

Field	Type	Label	Description
cluster	proto.cluster.v1alpha1.Cluster	optional

UpdateClusterResponse

Field	Type	Label	Description
cluster	proto.cluster.v1alpha1.Cluster	optional

UpdateTrustZoneRequest

Field	Type	Label	Description
trust_zone	proto.trust_zone.v1alpha1.TrustZone	optional

UpdateTrustZoneResponse

Field	Type	Label	Description
trust_zone	proto.trust_zone.v1alpha1.TrustZone	optional

ValidateRequest

ValidateResponse

DataSourcePluginService

Method Name	Request Type	Response Type	Description
Validate	ValidateRequest	ValidateResponse
AddTrustZone	AddTrustZoneRequest	AddTrustZoneResponse
DestroyTrustZone	DestroyTrustZoneRequest	DestroyTrustZoneResponse
GetTrustZone	GetTrustZoneRequest	GetTrustZoneResponse
ListTrustZones	ListTrustZonesRequest	ListTrustZonesResponse
UpdateTrustZone	UpdateTrustZoneRequest	UpdateTrustZoneResponse
AddCluster	AddClusterRequest	AddClusterResponse
DestroyCluster	DestroyClusterRequest	DestroyClusterResponse
GetCluster	GetClusterRequest	GetClusterResponse
ListClusters	ListClustersRequest	ListClustersResponse
UpdateCluster	UpdateClusterRequest	UpdateClusterResponse
AddAttestationPolicy	AddAttestationPolicyRequest	AddAttestationPolicyResponse
DestroyAttestationPolicy	DestroyAttestationPolicyRequest	DestroyAttestationPolicyResponse
GetAttestationPolicy	GetAttestationPolicyRequest	GetAttestationPolicyResponse
ListAttestationPolicies	ListAttestationPoliciesRequest	ListAttestationPoliciesResponse
AddAPBinding	AddAPBindingRequest	AddAPBindingResponse
DestroyAPBinding	DestroyAPBindingRequest	DestroyAPBindingResponse
ListAPBindings	ListAPBindingsRequest	ListAPBindingsResponse
AddFederation	AddFederationRequest	AddFederationResponse
DestroyFederation	DestroyFederationRequest	DestroyFederationResponse
ListFederations	ListFederationsRequest	ListFederationsResponse
ListFederationsByTrustZone	ListFederationsByTrustZoneRequest	ListFederationsByTrustZoneResponse

Top

proto/plugins/v1alpha1/plugins.proto

Plugins

Field	Type	Label	Description
data_source	string	optional
provision	string	optional

Top

proto/config/v1alpha1/config.proto

Config

Field	Type	Label	Description
trust_zones	proto.trust_zone.v1alpha1.TrustZone	repeated
clusters	proto.cluster.v1alpha1.Cluster	repeated
attestation_policies	proto.attestation_policy.v1alpha1.AttestationPolicy	repeated
plugin_config	Config.PluginConfigEntry	repeated
plugins	proto.plugins.v1alpha1.Plugins	optional
federations	proto.federation.v1alpha1.Federation	repeated
ap_bindings	proto.ap_binding.v1alpha1.APBinding	repeated

Config.PluginConfigEntry

Field	Type	Label	Description
key	string
value	google.protobuf.Struct

Top

proto/federated_service/v1alpha1/federated_service.proto

This file defines the FederatedService message and related types used to describe services that are exposed for secure cross-zone connectivity. A federated service enables workloads in remote trust zones to discover and connect to a service using mTLS.

FederatedService

FederatedService simplifies secure connectivity between workloads in different trust zones. Combined with a federation, the Cofide Agent facilitates discovery of and mTLS connectivity to this service from remote trust zones. Connectivity is available via xDS (Envoy) and the Cofide Go SDK. FederatedServices are typically created from a Kubernetes Custom Resource applied to the cluster in which the service runs.

Field	Type	Label	Description
id	string
name	string
namespace	string
cluster_name	string
trust_domain	string		The SPIFFE trust domain of the cluster in which this service runs.
workload_labels	FederatedService.WorkloadLabelsEntry	repeated	Kubernetes labels used to select the pods backing this service.
exported_trust_domains	string	repeated	The remote trust domains to which this service is exported.
port	uint32
gateway_entries	GatewayEntry	repeated	Gateway entries discovered automatically by the Cofide Agent.
gateway_specs	GatewaySpec	repeated	Gateway addresses manually specified in the FederatedService resource.
tls_mode	TLSMode

FederatedService.WorkloadLabelsEntry

Field	Type	Label	Description
key	string
value	string

GatewayEntry

GatewayEntry is a gateway address discovered automatically by the Cofide Agent for routing traffic to a federated service.

Field	Type	Label	Description
hostname	string
type	string
ip	string
port	int32

GatewaySpec

GatewaySpec is a manually specified gateway address for a federated service, provided when automatic gateway discovery is not available or sufficient.

Field	Type	Label	Description
hostname	string
type	string
ip	string
port	int32

TLSMode

TLSMode specifies the mutual TLS mode used for a federated service connection.

Name	Number	Description
TLS_MODE_UNSPECIFIED	0
TLS_MODE_MTLS	1	Standard SPIFFE mTLS using SPIRE-issued SVIDs.
TLS_MODE_ISTIO_MTLS	2	Istio-managed mTLS, for clusters using an Istio service mesh.

Top

proto/connect/agent_service/v1alpha1/agent_service.proto

This file defines the AgentService gRPC service, which is used by Cofide Agents to register with the Connect control plane and to manage the federated services running in their cluster.

CreateAgentJoinTokenRequest

Field	Type	Label	Description
trust_zone_id	string	optional
cluster_id	string	optional

CreateAgentJoinTokenResponse

Field	Type	Label	Description
agent_token	string	optional

DeregisterFederatedServiceRequest

Field	Type	Label	Description
service_id	string

DeregisterFederatedServiceResponse

Field	Type	Label	Description
service_id	string

GetFederatedServiceRequest

Field	Type	Label	Description
service_id	string

GetFederatedServiceResponse

Field	Type	Label	Description
service	proto.federated_service.v1alpha1.FederatedService

ListFederatedServicesRequest

Field	Type	Label	Description
org_id	string

ListFederatedServicesResponse

Field	Type	Label	Description
services	proto.federated_service.v1alpha1.FederatedService	repeated

RegisterFederatedServiceRequest

Field	Type	Label	Description
service	proto.federated_service.v1alpha1.FederatedService

RegisterFederatedServiceResponse

Field	Type	Label	Description
service_id	string

UpdateAgentStatusRequest

Field	Type	Label	Description
status	proto.agent.v1alpha1.AgentStatus

UpdateAgentStatusResponse

UpdateFederatedServiceRequest

Field	Type	Label	Description
service	proto.federated_service.v1alpha1.FederatedService

UpdateFederatedServiceResponse

Field	Type	Label	Description
service_id	string

AgentService

AgentService is used by Cofide Agents to register with the Connect control plane and to manage the federated services running in their cluster.

Method Name	Request Type	Response Type	Description
CreateAgentJoinToken	CreateAgentJoinTokenRequest	CreateAgentJoinTokenResponse	CreateAgentJoinToken generates a one-time token that a Cofide Agent uses to join a specific trust zone and cluster.
UpdateAgentStatus	UpdateAgentStatusRequest	UpdateAgentStatusResponse	UpdateAgentStatus reports the current operational status of a Cofide Agent to the Connect control plane.
RegisterFederatedService	RegisterFederatedServiceRequest	RegisterFederatedServiceResponse	RegisterFederatedService registers a federated service discovered by the agent, making it available for cross-zone connectivity.
DeregisterFederatedService	DeregisterFederatedServiceRequest	DeregisterFederatedServiceResponse	DeregisterFederatedService removes a previously registered federated service.
UpdateFederatedService	UpdateFederatedServiceRequest	UpdateFederatedServiceResponse	UpdateFederatedService updates the configuration of a registered federated service.
GetFederatedService	GetFederatedServiceRequest	GetFederatedServiceResponse	GetFederatedService retrieves a federated service by ID.
ListFederatedServices	ListFederatedServicesRequest	ListFederatedServicesResponse	ListFederatedServices lists all federated services for an organization.

Top

proto/connect/ap_binding_service/v1alpha1/ap_binding_service.proto

This file defines the APBindingService gRPC service for managing attestation policy bindings in the Connect control plane. Bindings associate an attestation policy with a trust zone, enabling SPIFFE identity issuance for workloads matching the policy within that zone.

CreateAPBindingRequest

Field	Type	Label	Description
binding	proto.ap_binding.v1alpha1.APBinding	optional

CreateAPBindingResponse

Field	Type	Label	Description
binding	proto.ap_binding.v1alpha1.APBinding	optional

DestroyAPBindingRequest

Field	Type	Label	Description
binding_id	string	optional

DestroyAPBindingResponse

GetAPBindingRequest

Field	Type	Label	Description
binding_id	string	optional

GetAPBindingResponse

Field	Type	Label	Description
binding	proto.ap_binding.v1alpha1.APBinding	optional

ListAPBindingsRequest

Field	Type	Label	Description
filter	ListAPBindingsRequest.Filter	optional

ListAPBindingsRequest.Filter

Field	Type	Label	Description
org_id	string	optional
trust_zone_id	string	optional
policy_id	string	optional

ListAPBindingsResponse

Field	Type	Label	Description
bindings	proto.ap_binding.v1alpha1.APBinding	repeated

UpdateAPBindingRequest

Field	Type	Label	Description
binding	proto.ap_binding.v1alpha1.APBinding	optional

UpdateAPBindingResponse

Field	Type	Label	Description
binding	proto.ap_binding.v1alpha1.APBinding	optional

APBindingService

APBindingService manages attestation policy bindings. Bindings associate an attestation policy with a trust zone, enabling Connect to issue SPIFFE identities to workloads that match the policy within that zone. Bindings can also specify federated trust zones to provide the bundles of federated trust zones to matching workloads.

Method Name	Request Type	Response Type	Description
CreateAPBinding	CreateAPBindingRequest	CreateAPBindingResponse	CreateAPBinding creates a new attestation policy binding.
DestroyAPBinding	DestroyAPBindingRequest	DestroyAPBindingResponse	DestroyAPBinding deletes an attestation policy binding by ID.
GetAPBinding	GetAPBindingRequest	GetAPBindingResponse	GetAPBinding retrieves an attestation policy binding by ID.
ListAPBindings	ListAPBindingsRequest	ListAPBindingsResponse	ListAPBindings returns all attestation policy bindings matching the optional filter.
UpdateAPBinding	UpdateAPBindingRequest	UpdateAPBindingResponse	UpdateAPBinding updates an existing attestation policy binding.

Top

proto/connect/attestation_policy_service/v1alpha1/attestation_policy_service.proto

This file defines the AttestationPolicyService gRPC service for managing attestation policies in the Connect control plane. Attestation policies specify the criteria used to issue SPIFFE identities to workloads and support Kubernetes, static, and TPM node attestation types.

CreateAttestationPolicyRequest

Field	Type	Label	Description
policy	proto.attestation_policy.v1alpha1.AttestationPolicy	optional

CreateAttestationPolicyResponse

Field	Type	Label	Description
policy	proto.attestation_policy.v1alpha1.AttestationPolicy	optional

DestroyAttestationPolicyRequest

Field	Type	Label	Description
policy_id	string	optional

DestroyAttestationPolicyResponse

GetAttestationPolicyRequest

Field	Type	Label	Description
policy_id	string	optional

GetAttestationPolicyResponse

Field	Type	Label	Description
policy	proto.attestation_policy.v1alpha1.AttestationPolicy	optional

ListAttestationPoliciesRequest

Field	Type	Label	Description
filter	ListAttestationPoliciesRequest.Filter	optional

ListAttestationPoliciesRequest.Filter

Field	Type	Label	Description
name	string	optional
org_id	string	optional
trust_zone_id	string	optional
kind	AttestationPolicyKind	optional
tpm_node	ListAttestationPoliciesRequest.TPMNodeFilter	optional

ListAttestationPoliciesRequest.TPMNodeFilter

Field	Type	Label	Description
ek_hash	string	optional

ListAttestationPoliciesResponse

Field	Type	Label	Description
policies	proto.attestation_policy.v1alpha1.AttestationPolicy	repeated

UpdateAttestationPolicyRequest

Field	Type	Label	Description
policy	proto.attestation_policy.v1alpha1.AttestationPolicy	optional

UpdateAttestationPolicyResponse

Field	Type	Label	Description
policy	proto.attestation_policy.v1alpha1.AttestationPolicy	optional

AttestationPolicyKind

AttestationPolicyKind enumerates the supported attestation policy types.

Name	Number	Description
ATTESTATION_POLICY_KIND_UNSPECIFIED	0
ATTESTATION_POLICY_KIND_KUBERNETES	1
ATTESTATION_POLICY_KIND_STATIC	2
ATTESTATION_POLICY_KIND_TPM_NODE	3

AttestationPolicyService

AttestationPolicyService manages attestation policies. Attestation policies define the criteria (namespace selectors, pod labels, TPM EK hashes, etc.) used to issue SPIFFE identities to workloads. Policies are bound to trust zones via the APBindingService.

Method Name	Request Type	Response Type	Description
CreateAttestationPolicy	CreateAttestationPolicyRequest	CreateAttestationPolicyResponse	CreateAttestationPolicy creates a new attestation policy.
DestroyAttestationPolicy	DestroyAttestationPolicyRequest	DestroyAttestationPolicyResponse	DestroyAttestationPolicy deletes an attestation policy by ID.
GetAttestationPolicy	GetAttestationPolicyRequest	GetAttestationPolicyResponse	GetAttestationPolicy retrieves an attestation policy by ID.
ListAttestationPolicies	ListAttestationPoliciesRequest	ListAttestationPoliciesResponse	ListAttestationPolicies returns all attestation policies matching the optional filter.
UpdateAttestationPolicy	UpdateAttestationPolicyRequest	UpdateAttestationPolicyResponse	UpdateAttestationPolicy updates an existing attestation policy.

Top

proto/connect/cluster_service/v1alpha1/cluster_service.proto

This file defines the ClusterService gRPC service for managing clusters registered with the Connect control plane. Each cluster belongs to a trust zone.

CreateClusterRequest

Field	Type	Label	Description
cluster	proto.cluster.v1alpha1.Cluster	optional

CreateClusterResponse

Field	Type	Label	Description
cluster	proto.cluster.v1alpha1.Cluster	optional

DestroyClusterRequest

Field	Type	Label	Description
cluster_id	string	optional

DestroyClusterResponse

GetClusterRequest

Field	Type	Label	Description
cluster_id	string	optional

GetClusterResponse

Field	Type	Label	Description
cluster	proto.cluster.v1alpha1.Cluster	optional

ListClustersRequest

Field	Type	Label	Description
filter	ListClustersRequest.Filter	optional

ListClustersRequest.Filter

Field	Type	Label	Description
name	string	optional
org_id	string	optional
trust_zone_id	string	optional

ListClustersResponse

Field	Type	Label	Description
clusters	proto.cluster.v1alpha1.Cluster	repeated

UpdateClusterRequest

Field	Type	Label	Description
cluster	proto.cluster.v1alpha1.Cluster	optional

UpdateClusterResponse

Field	Type	Label	Description
cluster	proto.cluster.v1alpha1.Cluster	optional

ClusterService

ClusterService manages clusters registered with the Connect control plane. Each cluster belongs to a trust zone.

Method Name	Request Type	Response Type	Description
CreateCluster	CreateClusterRequest	CreateClusterResponse	CreateCluster registers a new cluster with the Connect control plane.
DestroyCluster	DestroyClusterRequest	DestroyClusterResponse	DestroyCluster removes a cluster from the Connect control plane.
GetCluster	GetClusterRequest	GetClusterResponse	GetCluster retrieves a cluster by ID.
ListClusters	ListClustersRequest	ListClustersResponse	ListClusters returns all clusters matching the optional filter.
UpdateCluster	UpdateClusterRequest	UpdateClusterResponse	UpdateCluster updates the configuration of an existing cluster.

Top

proto/connect/datastore_service/v1alpha1/datastore.proto

AttestedNode

Represents an attested SPIRE agent

Field	Type	Label	Description
org_id	string		Organisation ID
trust_zone_id	string		Trust zone ID
spiffe_id	string		Node SPIFFE ID
attestation_data_type	string		Attestation data type
cert_serial_number	string		Node certificate serial number
cert_not_after	int64		Node certificate not_after (seconds since unix epoch)
new_cert_serial_number	string		Node certificate serial number
new_cert_not_after	int64		Node certificate not_after (seconds since unix epoch)
selectors	Selector	repeated	Node selectors
can_reattest	bool		CanReattest field (can the attestation safely be deleted and recreated automatically)

Selector

A type which describes the conditions under which a registration entry is matched.

Field	Type	Label	Description
type	string		A selector type represents the type of attestation used in attesting the entity (Eg: AWS, K8).
value	string		The value to be attested.

Selectors

Represents a type with a list of Selector.

Field	Type	Label	Description
entries	Selector	repeated	A list of Selector.

Top

proto/connect/datastore_service/v1alpha1/datastore_service.proto

AttestedNodeMask

Field	Type	Label	Description
attestation_data_type	bool
cert_serial_number	bool
cert_not_after	bool
new_cert_serial_number	bool
new_cert_not_after	bool
can_reattest	bool

CountAttestedNodesRequest

Node operations request/response messages

Field	Type	Label	Description
trust_zone_id	string	optional

CountAttestedNodesResponse

Field	Type	Label	Description
count	int32

CreateAttestedNodeRequest

Field	Type	Label	Description
node	AttestedNode
trust_zone_id	string	optional

CreateAttestedNodeResponse

Field	Type	Label	Description
node	AttestedNode

DeleteAttestedNodeRequest

Field	Type	Label	Description
spiffe_id	string
trust_zone_id	string	optional

DeleteAttestedNodeResponse

Field	Type	Label	Description
node	AttestedNode	optional

FetchAttestedNodeRequest

Field	Type	Label	Description
spiffe_id	string
trust_zone_id	string	optional

FetchAttestedNodeResponse

Field	Type	Label	Description
node	AttestedNode	optional

GetNodeSelectorsRequest

Node Selector operations request/response messages

Field	Type	Label	Description
spiffe_id	string
trust_zone_id	string	optional

GetNodeSelectorsResponse

Field	Type	Label	Description
spiffe_id	string
selectors	Selector	repeated

ListAttestedNodesRequest

Field	Type	Label	Description
by_attestation_type	string	optional	Filters nodes by attestation type
by_banned	bool	optional	Filters nodes by banned status
by_expires_before	int64	optional	Filters nodes that expire before the specified timestamp
by_selector_match	ListAttestedNodesRequest.BySelectors	optional
fetch_selectors	bool	optional	Whether to fetch selectors with nodes
by_can_reattest	bool	optional	Filters nodes by ability to re-attest
trust_zone_id	string	optional

ListAttestedNodesRequest.BySelectors

Filters nodes by selectors

Field	Type	Label	Description
selectors	Selector	repeated
match	ListAttestedNodesRequest.MatchBehavior

ListAttestedNodesResponse

Field	Type	Label	Description
nodes	AttestedNode	repeated

ListNodeSelectorsRequest

Field	Type	Label	Description
valid_at	int64	optional
trust_zone_id	string	optional

ListNodeSelectorsResponse

Field	Type	Label	Description
selectors	ListNodeSelectorsResponse.SelectorsEntry	repeated

ListNodeSelectorsResponse.NodeSelectors

Field	Type	Label	Description
selectors	Selector	repeated

ListNodeSelectorsResponse.SelectorsEntry

Field	Type	Label	Description
key	string
value	ListNodeSelectorsResponse.NodeSelectors

PruneAttestedExpiredNodesRequest

Field	Type	Label	Description
trust_zone_id	string
expired_before	google.protobuf.Timestamp
include_non_reattestable	bool

PruneAttestedExpiredNodesResponse

SetNodeSelectorsRequest

Field	Type	Label	Description
spiffe_id	string
selectors	Selector	repeated
trust_zone_id	string	optional

SetNodeSelectorsResponse

UpdateAttestedNodeRequest

Field	Type	Label	Description
node	AttestedNode
mask	AttestedNodeMask
trust_zone_id	string	optional

UpdateAttestedNodeResponse

Field	Type	Label	Description
node	AttestedNode	optional

ListAttestedNodesRequest.MatchBehavior

Name	Number	Description
MATCH_BEHAVIOR_EXACT_UNSPECIFIED	0
MATCH_BEHAVIOR_SUBSET	1
MATCH_BEHAVIOR_SUPERSET	2
MATCH_BEHAVIOR_MATCH_ANY	3

DataStoreService

DataStoreService defines the gRPC service for the SPIRE server DataStore interface

Method Name	Request Type	Response Type	Description
CountAttestedNodes	CountAttestedNodesRequest	CountAttestedNodesResponse	Node operations
CreateAttestedNode	CreateAttestedNodeRequest	CreateAttestedNodeResponse
DeleteAttestedNode	DeleteAttestedNodeRequest	DeleteAttestedNodeResponse
FetchAttestedNode	FetchAttestedNodeRequest	FetchAttestedNodeResponse
UpdateAttestedNode	UpdateAttestedNodeRequest	UpdateAttestedNodeResponse
ListAttestedNodes	ListAttestedNodesRequest	ListAttestedNodesResponse
PruneAttestedExpiredNodes	PruneAttestedExpiredNodesRequest	PruneAttestedExpiredNodesResponse
GetNodeSelectors	GetNodeSelectorsRequest	GetNodeSelectorsResponse	Node Selector operations
SetNodeSelectors	SetNodeSelectorsRequest	SetNodeSelectorsResponse
ListNodeSelectors	ListNodeSelectorsRequest	ListNodeSelectorsResponse

Top

proto/exchange_policy/v1alpha1/exchange_policy.proto

ExchangePolicy

ExchangePolicy defines a rule for permitting or denying Credex token exchanges within a trust zone

Field	Type	Label	Description
id	string		The unique ID of the exchange policy. Generated by the server.
org_id	string		Organization to which the exchange policy belongs. Derived from the trust zone by the API service.
name	string
trust_zone_id	string		Trust zone to which this policy applies. Immutable after creation.
action	ExchangePolicyAction	optional	Action to take when all conditions match. Defaults to ALLOW when unset.
subject_identity	StringSet		Match conditions on the inbound subject token
subject_issuer	StringSet
actor_identity	StringSet		Match conditions on the optional inbound actor
actor_issuer	StringSet
client_id	StringSet		Match condition on the OAuth client_id presenting the exchange request
target_audience	StringSet		Match condition on the requested target audience
outbound_scopes	string	repeated	Outbound scopes to grant. Only relevant when action is ALLOW.

StringMatcher

Field	Type	Label	Description
exact	string		Exact string equality.
glob	string		Glob pattern (e.g. spiffe://trust.domain/ns//sa/).

StringSet

StringSet holds a collection of StringMatchers evaluated with OR semantics.

Field	Type	Label	Description
matchers	StringMatcher	repeated

ExchangePolicyAction

ExchangePolicyAction determines whether a Credex token exchange is permitted when all conditions of an ExchangePolicy match.

Name	Number	Description
EXCHANGE_POLICY_ACTION_UNSPECIFIED	0	treated as ALLOW
EXCHANGE_POLICY_ACTION_ALLOW	1
EXCHANGE_POLICY_ACTION_DENY	2

Top

proto/connect/exchange_policy_service/v1alpha1/exchange_policy_service.proto

CreateExchangePolicyRequest

Field	Type	Label	Description
exchange_policy	proto.exchange_policy.v1alpha1.ExchangePolicy

CreateExchangePolicyResponse

Field	Type	Label	Description
exchange_policy	proto.exchange_policy.v1alpha1.ExchangePolicy

DestroyExchangePolicyRequest

Field	Type	Label	Description
exchange_policy_id	string

DestroyExchangePolicyResponse

GetExchangePolicyRequest

Field	Type	Label	Description
exchange_policy_id	string

GetExchangePolicyResponse

Field	Type	Label	Description
exchange_policy	proto.exchange_policy.v1alpha1.ExchangePolicy	optional

ListExchangePoliciesRequest

Field	Type	Label	Description
filter	ListExchangePoliciesRequest.Filter

ListExchangePoliciesRequest.Filter

Field	Type	Label	Description
name	string
org_id	string
trust_zone_id	string

ListExchangePoliciesResponse

Field	Type	Label	Description
exchange_policies	proto.exchange_policy.v1alpha1.ExchangePolicy	repeated

UpdateExchangePolicyRequest

Field	Type	Label	Description
exchange_policy	proto.exchange_policy.v1alpha1.ExchangePolicy
update_mask	UpdateExchangePolicyRequest.UpdateMask		The list of fields to be updated. If not provided a full replacement will be made.

UpdateExchangePolicyRequest.UpdateMask

Field	Type	Label	Description
name	bool		Set to true to update the name field.
action	bool		Set to true to update the action field.
subject_identity	bool		Set to true to update the subject_identity field.
subject_issuer	bool		Set to true to update the subject_issuer field.
actor_identity	bool		Set to true to update the actor_identity field.
actor_issuer	bool		Set to true to update the actor_issuer field.
client_id	bool		Set to true to update the client_id field.
target_audience	bool		Set to true to update the target_audience field.
outbound_scopes	bool		Set to true to update the outbound_scopes field.

UpdateExchangePolicyResponse

Field	Type	Label	Description
exchange_policy	proto.exchange_policy.v1alpha1.ExchangePolicy

ExchangePolicyService

ExchangePolicyService manages exchange policies that govern Credex token exchanges within a trust zone. Each policy defines conditions on the inbound token (subject, issuer, actor, client ID, target audience) and determines whether the exchange is allowed or denied.

Method Name	Request Type	Response Type	Description
CreateExchangePolicy	CreateExchangePolicyRequest	CreateExchangePolicyResponse	CreateExchangePolicy creates a new exchange policy.
DestroyExchangePolicy	DestroyExchangePolicyRequest	DestroyExchangePolicyResponse	DestroyExchangePolicy deletes an exchange policy by ID.
GetExchangePolicy	GetExchangePolicyRequest	GetExchangePolicyResponse	GetExchangePolicy retrieves an exchange policy by ID.
ListExchangePolicies	ListExchangePoliciesRequest	ListExchangePoliciesResponse	ListExchangePolicies returns all exchange policies matching the optional filter.
UpdateExchangePolicy	UpdateExchangePolicyRequest	UpdateExchangePolicyResponse	UpdateExchangePolicy updates an existing exchange policy. An optional update mask specifies which fields to update; if omitted, a full replacement is made.

Top

proto/connect/federation_service/v1alpha1/federation_service.proto

This file defines the FederationService gRPC service for managing federations between trust zones in the Connect control plane. Federations establish trust relationships that allow workloads in each zone to present their SPIFFE identities to workloads in the other, enabling secure connectivity across zone boundaries.

CreateFederationRequest

Field	Type	Label	Description
federation	proto.federation.v1alpha1.Federation

CreateFederationResponse

Field	Type	Label	Description
federation	proto.federation.v1alpha1.Federation

DestroyFederationRequest

Field	Type	Label	Description
federation_id	string	optional

DestroyFederationResponse

GetFederationRequest

Field	Type	Label	Description
federation_id	string

GetFederationResponse

Field	Type	Label	Description
federation	proto.federation.v1alpha1.Federation

ListFederationsRequest

Field	Type	Label	Description
filter	ListFederationsRequest.Filter	optional

ListFederationsRequest.Filter

Field	Type	Label	Description
org_id	string	optional
trust_zone_id	string	optional
remote_trust_zone_id	string	optional

ListFederationsResponse

Field	Type	Label	Description
federations	proto.federation.v1alpha1.Federation	repeated

FederationService

FederationService manages federations between trust zones. A federation establishes a trust relationship that allows workloads in each zone to present their SPIFFE identities to workloads in the other, enabling secure connectivity across zone boundaries. Attestation policy bindings control which workloads can federate.

Method Name	Request Type	Response Type	Description
CreateFederation	CreateFederationRequest	CreateFederationResponse	CreateFederation creates a new federation between two trust zones.
DestroyFederation	DestroyFederationRequest	DestroyFederationResponse	DestroyFederation removes a federation by ID.
ListFederations	ListFederationsRequest	ListFederationsResponse	ListFederations returns all federations matching the optional filter.
GetFederation	GetFederationRequest	GetFederationResponse	GetFederation retrieves a federation by ID.

Top

proto/identity/v1alpha1/identity.proto

This file defines the Identity message and related types representing SPIFFE identities (SVIDs) issued by Connect to workloads on attested nodes. Each identity records the SPIFFE ID, attestation selectors, and federation configuration for a workload matched by an attestation policy.

Identity

Identity represents a SPIFFE identity (SVID) issued by Connect to a workload on an attested node. Each identity is derived from a matching attestation policy and carries the SPIFFE ID, attestation selectors, and optional federation configuration for the workload.

Field	Type	Label	Description
id	string
org_id	string
trust_zone_id	string
cluster_id	string
attestation_policy_id	string		The attestation policy that matched this workload.
ap_binding_id	string		The attestation policy binding through which this identity was issued.
workload_id	string		The workload to which this identity was issued.
spiffe_id	string		The SPIFFE ID issued to the workload, e.g. spiffe://trust-domain/ns/foo/sa/bar.
parent_id	string		The SPIFFE ID of the SPIRE agent node that attested this workload.
selectors	Selector	repeated	Attestation selectors produced by workload attestation plugins (e.g. k8s, unix).
dns_names	string	repeated	DNS names to include as DNS Subject Alternative Names (SANs).
federations	IdentityFederation	repeated	Federated trust zones or trust domains with which this identity is shared.
created_at	google.protobuf.Timestamp

IdentityFederation

IdentityFederation specifies a federated trust zone or trust domain with which an identity is shared, enabling the workload to present its SVID to workloads in the remote zone.

Field	Type	Label	Description
trust_zone_id	string
trust_domain	string

Selector

Selector is an attestation selector produced by a workload attestation plugin (e.g. k8s, unix, docker). Selectors are used to match a workload against attestation policies to determine which SPIFFE ID to issue.

Field	Type	Label	Description
type	string		The attestation plugin type, e.g. “k8s”, “unix”, “docker”.
value	string		The selector value, e.g. “ns:foo”, “user:1000”.

Top

proto/connect/identity_service/v1alpha1/identity_service.proto

This file defines the IdentityService gRPC service, which provides read-only access to SPIFFE identities (SVIDs) issued by Connect. Identities are derived from attestation policy bindings and record the SPIFFE ID, attestation selectors, and federation configuration for each attested workload.

GetIdentityRequest

Field	Type	Label	Description
identity_id	string

GetIdentityResponse

Field	Type	Label	Description
identity	proto.identity.v1alpha1.Identity

ListIdentitiesRequest

Field	Type	Label	Description
filter	ListIdentitiesRequest.Filter	optional

ListIdentitiesRequest.Filter

Field	Type	Label	Description
org_id	string	optional
trust_zone_id	string	optional
cluster_id	string	optional
attestation_policy_id	string	optional
ap_binding_id	string	optional
workload_id	string	optional
spiffe_id	string	optional

ListIdentitiesResponse

Field	Type	Label	Description
identities	proto.identity.v1alpha1.Identity	repeated

IdentityService

IdentityService provides read-only access to the SPIFFE identities (SVIDs) issued by Connect to workloads on attested nodes. Identities are derived from attestation policy bindings and carry the SPIFFE ID, selectors, and federation configuration for each workload.

Method Name	Request Type	Response Type	Description
GetIdentity	GetIdentityRequest	GetIdentityResponse	GetIdentity retrieves a SPIFFE identity by ID.
ListIdentities	ListIdentitiesRequest	ListIdentitiesResponse	ListIdentities returns all identities matching the optional filter.

Top

proto/organization/v1alpha1/organization.proto

This file defines the Organization message representing the top-level grouping of resources in the Connect control plane. Trust zones, attestation policies, and role bindings are all scoped to an organization.

Organization

Organization is the top-level grouping of Connect resources. Trust zones, attestation policies, and role bindings are all scoped to an organization.

Field	Type	Label	Description
id	string
name	string

Top

proto/connect/organization_service/v1alpha1/organization_service.proto

This file defines the OrganizationService gRPC service, which provides read-only access to organizations in the Connect control plane. Organizations are the top-level grouping of resources: trust zones and attestation policies are scoped to an organization.

GetOrganizationRequest

Field	Type	Label	Description
org_id	string	optional

GetOrganizationResponse

Field	Type	Label	Description
organization	proto.organization.v1alpha1.Organization	optional

ListOrganizationsRequest

Field	Type	Label	Description
filter	ListOrganizationsRequest.Filter	optional

ListOrganizationsRequest.Filter

Field	Type	Label	Description
name	string	optional

ListOrganizationsResponse

Field	Type	Label	Description
organizations	proto.organization.v1alpha1.Organization	repeated

OrganizationService

OrganizationService provides read-only access to organizations. Organizations are the top-level grouping of Connect resources: trust zones and attestation policies are scoped to an organization.

Method Name	Request Type	Response Type	Description
GetOrganization	GetOrganizationRequest	GetOrganizationResponse	GetOrganization retrieves an organization by ID.
ListOrganizations	ListOrganizationsRequest	ListOrganizationsResponse	ListOrganizations returns all organizations matching the optional filter.

Top

proto/role_binding/v1alpha1/role_binding.proto

This file defines the RoleBinding message and related types used by Connect’s Role-Based Access Control (RBAC) system. Role bindings associate a principal (user or group) with a predefined role on a specific resource, with permissions inherited down the resource hierarchy. RBAC is enforced server-side.

Group

Group identifies a set of principals by a group claim value in the JWT presented by users. This allows role bindings to be applied to all members of a group as managed by the configured identity provider.

Field	Type	Label	Description
claim_value	string		For users this is matched against the list of values in the “groups” claim of the JWT presented by a user.

Resource

Resource identifies the target of a role binding. Role bindings can be applied to System, Organization, Trust Zone, or Cluster resources. Permissions are inherited down the resource hierarchy from the bound resource.

Field	Type	Label	Description
type	string		type can be one of the following: AttestationPolicyBinding AttestationPolicy Cluster FederatedService Federation Organization System TrustZone
id	string

RoleBinding

RoleBinding associates a principal (user or group) with a role on a specific resource. Permissions defined by the role are granted on the target resource and inherited by all child resources in the resource hierarchy. Connect’s RBAC policies are enforced server-side.

Field	Type	Label	Description
id	string
role_id	string		The role granted by this binding. See the Connect access control documentation for the list of available roles.
user	User
group	Group
resource	Resource

User

User identifies an individual principal by the “sub” (subject) claim of the JWT presented by that user to the configured identity provider.

Field	Type	Label	Description
subject	string		This is matched against the “sub” claim of the JWT presented by a user.

Top

proto/connect/role_binding_service/v1alpha1/role_binding_service.proto

This file defines the RoleBindingService gRPC service for managing role bindings in Connect’s RBAC system. Role bindings associate a principal (user or group) with a predefined role on a resource, granting permissions on that resource and all child resources in the hierarchy. Policies are enforced server-side.

CreateRoleBindingRequest

Field	Type	Label	Description
role_binding	proto.role_binding.v1alpha1.RoleBinding

CreateRoleBindingResponse

Field	Type	Label	Description
role_binding	proto.role_binding.v1alpha1.RoleBinding

DestroyRoleBindingRequest

Field	Type	Label	Description
role_binding_id	string

DestroyRoleBindingResponse

GetRoleBindingRequest

Field	Type	Label	Description
role_binding_id	string

GetRoleBindingResponse

Field	Type	Label	Description
role_binding	proto.role_binding.v1alpha1.RoleBinding	optional

ListRoleBindingsRequest

Field	Type	Label	Description
filter	ListRoleBindingsRequest.Filter	optional

ListRoleBindingsRequest.Filter

Field	Type	Label	Description
role_id	string	optional
user_subject	string	optional
group_claim_value	string	optional
resource_type	string	optional
resource_id	string	optional

ListRoleBindingsResponse

Field	Type	Label	Description
role_bindings	proto.role_binding.v1alpha1.RoleBinding	repeated

UpdateRoleBindingRequest

Field	Type	Label	Description
role_binding	proto.role_binding.v1alpha1.RoleBinding

UpdateRoleBindingResponse

Field	Type	Label	Description
role_binding	proto.role_binding.v1alpha1.RoleBinding

RoleBindingService

RoleBindingService manages role bindings for Connect’s role-based access control (RBAC) system. Role bindings associate a principal (user or group) with a predefined role on a specific resource, granting the permissions defined by that role on the resource and all child resources in the hierarchy. RBAC policies are enforced server-side.

Method Name	Request Type	Response Type	Description
CreateRoleBinding	CreateRoleBindingRequest	CreateRoleBindingResponse	CreateRoleBinding creates a new role binding.
DestroyRoleBinding	DestroyRoleBindingRequest	DestroyRoleBindingResponse	DestroyRoleBinding removes a role binding by ID.
GetRoleBinding	GetRoleBindingRequest	GetRoleBindingResponse	GetRoleBinding retrieves a role binding by ID.
ListRoleBindings	ListRoleBindingsRequest	ListRoleBindingsResponse	ListRoleBindings returns all role bindings matching the optional filter.
UpdateRoleBinding	UpdateRoleBindingRequest	UpdateRoleBindingResponse	UpdateRoleBinding updates an existing role binding.

Top

proto/trust_zone_server/v1alpha1/trust_zone_server.proto

This file defines the TrustZoneServer message and related types describing how the SPIRE server managing a trust zone should be deployed. It includes lifecycle status tracking and configuration for k8s_psat node attestation when using the Connect datasource with remote clusters.

ConnectK8sPsatConfig

Field	Type	Label	Description
audiences	string	repeated	Audiences that can be presented by SPIRE agents in remote clusters to perform node attestation when this server is using the k8s psat plugin with the Connect datasource. At least 1 must be provided if there are remote clusters in the trust zone.
spire_server_spiffe_id_path	string		Path to use for the SPIFFE ID in the JWT presented by the SPIRE server to the cluster’s API server when this server is using the k8s psat plugin with the Connect datasource. This must be configured to be an allowed subject in the remote cluster’s API server.

TrustZoneServer

TrustZoneServer defines how the server managing a trust zone should be deployed.

Field	Type	Label	Description
id	string		The unique ID of the server. Generated by the server.
trust_zone_id	string		Trust Zone managed by this server. Immutable after creation.
cluster_id	string		Cluster in which the server should be deployed. Immutable after creation.
kubernetes_namespace	string		Kubernetes namespace in which the server should be deployed. If not provided the API service should set this.
kubernetes_service_account	string		Name of kubernetes service account to deploy with the server. If not provided the API service should set this.
org_id	string		Organization to which the server belongs. Derived from the trust zone by the API service.
helm_values	google.protobuf.Struct		Helm values to configure the server install with.
status	TrustZoneServer.Status		Current status of the trust zone server
created_at	google.protobuf.Timestamp		Time of resource creation by user.
last_updated_at	google.protobuf.Timestamp		Times of last resource update by user.
deleted_at	google.protobuf.Timestamp		Time of resource deletion by user.
connect_k8s_psat_config	ConnectK8sPsatConfig		Configuration for the k8s psat node attestor plugin when using a Connect datasource with remote clusters.

TrustZoneServer.Status

Field	Type	Label	Description
status	TrustZoneServerStatus		Last reported status of the trust zone server.
last_transition_time	google.protobuf.Timestamp		When the status of the trust zone server last changed.

TrustZoneServerStatus

Status of a trust zone server

Name	Number	Description
TRUST_ZONE_SERVER_STATUS_UNSPECIFIED	0
TRUST_ZONE_SERVER_STATUS_PROVISIONING	1	Provisioning / Deleting statuses are only applicable for managed trust zone servers
TRUST_ZONE_SERVER_STATUS_PROVISIONED	2
TRUST_ZONE_SERVER_STATUS_PROVISIONING_ERROR	3
TRUST_ZONE_SERVER_STATUS_DELETING	4
TRUST_ZONE_SERVER_STATUS_DELETED	5
TRUST_ZONE_SERVER_STATUS_DELETING_ERROR	6

Top

proto/connect/trust_zone_server_service/v1alpha1/trust_zone_server_service.proto

This file defines the TrustZoneServerService gRPC service for managing TrustZoneServers in the Connect control plane. A TrustZoneServer describes how the SPIRE server for a trust zone should be deployed into a cluster, including its lifecycle status and node attestation configuration.

CreateTrustZoneServerRequest

Field	Type	Label	Description
trust_zone_server	proto.trust_zone_server.v1alpha1.TrustZoneServer

CreateTrustZoneServerResponse

Field	Type	Label	Description
trust_zone_server	proto.trust_zone_server.v1alpha1.TrustZoneServer

DestroyTrustZoneServerRequest

Field	Type	Label	Description
trust_zone_server_id	string

DestroyTrustZoneServerResponse

GetTrustZoneServerRequest

Field	Type	Label	Description
trust_zone_server_id	string

GetTrustZoneServerResponse

Field	Type	Label	Description
trust_zone_server	proto.trust_zone_server.v1alpha1.TrustZoneServer	optional

ListTrustZoneServersRequest

Field	Type	Label	Description
filter	ListTrustZoneServersRequest.Filter

ListTrustZoneServersRequest.Filter

Field	Type	Label	Description
trust_zone_id	string
cluster_id	string
org_id	string

ListTrustZoneServersResponse

Field	Type	Label	Description
trust_zone_servers	proto.trust_zone_server.v1alpha1.TrustZoneServer	repeated

UpdateTrustZoneServerRequest

Field	Type	Label	Description
trust_zone_server	proto.trust_zone_server.v1alpha1.TrustZoneServer
update_mask	UpdateTrustZoneServerRequest.UpdateMask	optional	The list of fields to be updated. If not provided a full replacement will be made.

UpdateTrustZoneServerRequest.UpdateMask

Field	Type	Label	Description
helm_values	bool		Set to true to update helm values of trust zone server to those provided.

UpdateTrustZoneServerResponse

Field	Type	Label	Description
trust_zone_server	proto.trust_zone_server.v1alpha1.TrustZoneServer

UpdateTrustZoneServerStatusRequest

Field	Type	Label	Description
trust_zone_server_id	string
status	proto.trust_zone_server.v1alpha1.TrustZoneServerStatus

UpdateTrustZoneServerStatusResponse

TrustZoneServerService

TrustZoneServerService manages TrustZoneServers.

Method Name	Request Type	Response Type	Description
CreateTrustZoneServer	CreateTrustZoneServerRequest	CreateTrustZoneServerResponse	Create a TrustZoneServer for the given trust zone in the specified cluster. In the submitted resource the ID should not be set and will be generated by the server API.
DestroyTrustZoneServer	DestroyTrustZoneServerRequest	DestroyTrustZoneServerResponse	Destroy a TrustZoneServer. For managed TrustZoneServers this should soft delete the API resource until the managed server is deprovisioned.
GetTrustZoneServer	GetTrustZoneServerRequest	GetTrustZoneServerResponse	Get a TrustZoneServer by ID.
ListTrustZoneServers	ListTrustZoneServersRequest	ListTrustZoneServersResponse	List TrustZoneServers.
UpdateTrustZoneServer	UpdateTrustZoneServerRequest	UpdateTrustZoneServerResponse	Update a TrustZoneServer. Server implementations may prevent some fields from being updated.
UpdateTrustZoneServerStatus	UpdateTrustZoneServerStatusRequest	UpdateTrustZoneServerStatusResponse	Update the status of a trust zone server.

Top

proto/connect/trust_zone_service/v1alpha1/trust_zone_service.proto

This file defines the TrustZoneService gRPC service for managing trust zones and handling the registration of agents and SPIRE servers. Trust zones represent SPIFFE trust domains within the Connect platform; each has its own root of trust and can federate with other zones.

Agent

Agent identifies a Cofide Agent during registration with the trust zone service.

Field	Type	Label	Description
agent_id	string
cluster_id	string
trust_zone_id	string

CreateTrustZoneRequest

Field	Type	Label	Description
trust_zone	proto.trust_zone.v1alpha1.TrustZone

CreateTrustZoneResponse

Field	Type	Label	Description
trust_zone	proto.trust_zone.v1alpha1.TrustZone

DestroyTrustZoneRequest

Field	Type	Label	Description
trust_zone_id	string	optional

DestroyTrustZoneResponse

GetTrustZoneRequest

Field	Type	Label	Description
trust_zone_id	string	optional

GetTrustZoneResponse

Field	Type	Label	Description
trust_zone	proto.trust_zone.v1alpha1.TrustZone	optional

ListTrustZonesRequest

Field	Type	Label	Description
filter	ListTrustZonesRequest.Filter	optional

ListTrustZonesRequest.Filter

Field	Type	Label	Description
name	string	optional
org_id	string	optional
trust_domain	string	optional

ListTrustZonesResponse

Field	Type	Label	Description
trust_zones	proto.trust_zone.v1alpha1.TrustZone	repeated

RegisterAgentRequest

Field	Type	Label	Description
agent	Agent
agent_token	string
bundle	spire.api.types.Bundle

RegisterAgentResponse

Field	Type	Label	Description
agent_id	string

RegisterTrustZoneServerRequest

Field	Type	Label	Description
trust_zone_server	TrustZoneServer		To be deprecated, registration of a trust zone server by just specifying the cluster ID Consumers should provide a trust zone server ID instead
bundle	spire.api.types.Bundle
trust_zone_server_id	string

RegisterTrustZoneServerResponse

Empty for the moment

TrustZoneServer

TrustZoneServer identifies a SPIRE server by its cluster during registration. Deprecated: use trust_zone_server_id in RegisterTrustZoneServerRequest instead.

Field	Type	Label	Description
cluster_id	string

UpdateTrustZoneBundleRequest

Field	Type	Label	Description
bundle	spire.api.types.Bundle
trust_zone_id	string

UpdateTrustZoneBundleResponse

UpdateTrustZoneRequest

Field	Type	Label	Description
trust_zone	proto.trust_zone.v1alpha1.TrustZone

UpdateTrustZoneResponse

Field	Type	Label	Description
trust_zone	proto.trust_zone.v1alpha1.TrustZone

TrustZoneService

TrustZoneService manages trust zones and handles the registration of agents and servers. Trust zones represent SPIFFE trust domains within the Connect platform; each zone has its own root of trust and can federate with other zones.

Method Name	Request Type	Response Type	Description
CreateTrustZone	CreateTrustZoneRequest	CreateTrustZoneResponse	CreateTrustZone creates a new trust zone.
DestroyTrustZone	DestroyTrustZoneRequest	DestroyTrustZoneResponse	DestroyTrustZone removes a trust zone by ID.
GetTrustZone	GetTrustZoneRequest	GetTrustZoneResponse	GetTrustZone retrieves a trust zone by ID.
ListTrustZones	ListTrustZonesRequest	ListTrustZonesResponse	ListTrustZones returns all trust zones matching the optional filter.
UpdateTrustZone	UpdateTrustZoneRequest	UpdateTrustZoneResponse	UpdateTrustZone updates the configuration of an existing trust zone.
RegisterAgent	RegisterAgentRequest	RegisterAgentResponse	RegisterAgent registers a Cofide Agent with its trust zone after it has joined using a token from CreateAgentJoinToken. The agent provides its SPIRE bundle for storage in the control plane.
RegisterTrustZoneServer	RegisterTrustZoneServerRequest	RegisterTrustZoneServerResponse	RegisterTrustZoneServer registers the SPIRE server for a trust zone, storing its bundle in the control plane.
UpdateTrustZoneBundle	UpdateTrustZoneBundleRequest	UpdateTrustZoneBundleResponse	UpdateTrustZoneBundle updates the stored SPIRE trust bundle for a trust zone. Called by Cofide SPIRE server or Cofide Agent when the SPIRE server rotates its bundle.

Top

proto/workload/v1alpha1/workload.proto

This file defines the Workload message and related types representing processes and containers observed by Cofide Observer on attested nodes. Workload data is streamed to the Connect control plane and used to match workloads against attestation policies for SPIFFE identity issuance.

KubernetesContainer

KubernetesContainer describes a single container within a Kubernetes pod workload.

Field	Type	Label	Description
name	string
image	string

KubernetesMetadata

KubernetesMetadata contains standard Kubernetes object metadata for a workload.

Field	Type	Label	Description
uid	string
name	string
namespace	string
labels	KubernetesMetadata.LabelsEntry	repeated
annotations	KubernetesMetadata.AnnotationsEntry	repeated
creation_timestamp	google.protobuf.Timestamp

KubernetesMetadata.AnnotationsEntry

Field	Type	Label	Description
key	string
value	string

KubernetesMetadata.LabelsEntry

Field	Type	Label	Description
key	string
value	string

KubernetesPod

KubernetesPod contains the runtime details of a Kubernetes pod workload as observed by the Cofide Observer via the kubelet API.

Field	Type	Label	Description
metadata	KubernetesMetadata
service_account_name	string
node_name	string
node_uid	string
containers	KubernetesContainer	repeated
start_time	google.protobuf.Timestamp

Observation

Observation is a structured data point describing the security posture of the workload.

Field	Type	Label	Description
type_url	string
value	google.protobuf.Value

Workload

Workload represents a process, container, or unit of software running on an attested node. Workloads are observed by the Cofide Observer and reported to the Connect control plane. A SPIFFE identity (SVID) can be issued to a workload if it matches an active attestation policy binding within its trust zone.

Field	Type	Label	Description
id	string
org_id	string
trust_zone_id	string
cluster_id	string
type	WorkloadType
kubernetes_pod	KubernetesPod
observations	Observation	repeated	Security posture observations.
observed_timestamp	google.protobuf.Timestamp		When this workload was last observed by the Cofide Observer.
deleted	bool		Whether this workload has been deleted since it was last observed.

WorkloadType

WorkloadType enumerates the supported workload runtime types.

Name	Number	Description
WORKLOAD_TYPE_UNSPECIFIED	0
WORKLOAD_TYPE_KUBERNETES_POD	1

Top

proto/connect/workload_service/v1alpha1/workload_service.proto

This file defines the WorkloadService gRPC service for accessing workloads observed by Cofide Observers. Observers stream workload observations from the kubelet to the Connect control plane, where they are stored and matched against attestation policies for SPIFFE identity issuance.

ListWorkloadsRequest

Field	Type	Label	Description
filter	ListWorkloadsRequest.Filter	optional

ListWorkloadsRequest.Filter

Field	Type	Label	Description
org_id	string	optional
trust_zone_id	string	optional
cluster_id	string	optional
max_age	google.protobuf.Duration	optional	max_age filters workloads to those last observed within this duration.

ListWorkloadsResponse

Field	Type	Label	Description
workloads	proto.workload.v1alpha1.Workload	repeated

PublishWorkloadsRequest

Field	Type	Label	Description
workloads	proto.workload.v1alpha1.Workload	repeated

PublishWorkloadsResponse

WorkloadService

WorkloadService provides access to workloads observed by Cofide Observers. Observers stream workload observations from the kubelet to the Connect control plane, where they are stored and made available for query. Workloads can be matched against attestation policies to determine which SPIFFE identity to issue.

Method Name	Request Type	Response Type	Description
ListWorkloads	ListWorkloadsRequest	ListWorkloadsResponse	ListWorkloads returns all workloads matching the optional filter.
PublishWorkloads	PublishWorkloadsRequest stream	PublishWorkloadsResponse	PublishWorkloads is a client-streaming RPC used by Cofide Observers to report observed workloads to the Connect control plane.

Top

proto/provision_plugin/v1alpha1/plugin.proto

DeployRequest

Field	Type	Label	Description
data_source	uint32	optional
kube_cfg_file	string	optional
trust_zone_names	string	repeated

DeployResponse

Field	Type	Label	Description
status	Status	optional

GetHelmValuesRequest

Field	Type	Label	Description
data_source	uint32	optional
trust_zone_name	string	optional
cluster_name	string	optional

GetHelmValuesResponse

Field	Type	Label	Description
helm_values	google.protobuf.Struct	optional

Status

Field	Type	Label	Description
stage	string	optional
message	string	optional
done	bool	optional
error	string	optional

TearDownRequest

Field	Type	Label	Description
data_source	uint32	optional
kube_cfg_file	string	optional
trust_zone_names	string	repeated

TearDownResponse

Field	Type	Label	Description
status	Status	optional

ValidateRequest

ValidateResponse

ProvisionPluginService

Method Name	Request Type	Response Type	Description
Validate	ValidateRequest	ValidateResponse
Deploy	DeployRequest	DeployResponse stream
TearDown	TearDownRequest	TearDownResponse stream
GetHelmValues	GetHelmValuesRequest	GetHelmValuesResponse

Scalar Value Types

.proto Type	Notes	C++	Java	Python	Go	C#	PHP	Ruby
double		double	double	float	float64	double	float	Float
float		float	float	float	float32	float	float	Float
int32	Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint32 instead.	int32	int	int	int32	int	integer	Bignum or Fixnum (as required)
int64	Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint64 instead.	int64	long	int/long	int64	long	integer/string	Bignum
uint32	Uses variable-length encoding.	uint32	int	int/long	uint32	uint	integer	Bignum or Fixnum (as required)
uint64	Uses variable-length encoding.	uint64	long	int/long	uint64	ulong	integer/string	Bignum or Fixnum (as required)
sint32	Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int32s.	int32	int	int	int32	int	integer	Bignum or Fixnum (as required)
sint64	Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int64s.	int64	long	int/long	int64	long	integer/string	Bignum
fixed32	Always four bytes. More efficient than uint32 if values are often greater than 2^28.	uint32	int	int	uint32	uint	integer	Bignum or Fixnum (as required)
fixed64	Always eight bytes. More efficient than uint64 if values are often greater than 2^56.	uint64	long	int/long	uint64	ulong	integer/string	Bignum
sfixed32	Always four bytes.	int32	int	int	int32	int	integer	Bignum or Fixnum (as required)
sfixed64	Always eight bytes.	int64	long	int/long	int64	long	integer/string	Bignum
bool		bool	boolean	boolean	bool	bool	boolean	TrueClass/FalseClass
string	A string must always contain UTF-8 encoded or 7-bit ASCII text.	string	String	str/unicode	string	string	string	String (UTF-8)
bytes	May contain any arbitrary sequence of bytes.	string	ByteString	str	[]byte	ByteString	string	String (ASCII-8BIT)