spiffe/spire

bootstrapping trust bundle from another workload api

Open

#7,124 opened on Jul 7, 2026

View on GitHub
 (1 comment) (0 reactions) (0 assignees)Go (631 forks)auto 404
help wantedpriority/backlog

Repository metrics

Stars
 (2,443 stars)
PR merge metrics
 (PR metrics pending)

Description

When nesting spire-agents using x509, currently we need to use a separate process, that adapts the spire-workload-api to the spire server attesting unix socket so the nested agent can fetch the bootstrap trustbundle.

Here's the code that implements this: https://github.com/spiffe/spire-identity-exchange/blob/main/cmd/spire-server-attestor-spiffe-workload-api/main.go

It would be nice if we incorporated this functionality directly into the spire-agent so you could configure the bootstrap trust bundle along with the x509pop functionality without needing a separate daemon.

Proposal: add a trust_bundle_spiffe_workload_api property pointing at a spiffe workload socket.

Contributor guide

Research direction
Tech stack
Domain
Issue type
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Prerequisites
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.