maxlambrecht / rust-spiffe / 37048797123

94%

push

github

feat(spiffe): add experimental SPIFFE Broker API bindings

Add an experimental `broker-api` feature with bindings for the SPIFFE
Broker API (spiffe/spiffe#340):

- the generated `spiffe.broker` client and messages, under
  `broker_api::pb::spiffe::broker`. The client has no plaintext
  `connect`, because the Broker Endpoint requires mTLS.
- `SecurityHeader`, an interceptor that adds the required
  `broker.spiffe.io: true` metadata. Like the Workload API interceptor,
  it runs an optional custom interceptor first, so that interceptor
  cannot remove or overwrite the header.
- `From` conversions that pack PID and Kubernetes object references
  into a `WorkloadReference` with the full type URL. The conversions
  cannot enforce the reference scope from Broker API §3.1.2, so their
  docs and the module docs state the rules that the caller must
  enforce.
- a `Debug` for the SVID messages that shows only the length of the
  private key or token, like `PrivateKey` and the JWT `Token`.

`cargo run -p xtask -- gen spiffe` also generates these bindings,
without tonic transport code. The Workload API and spire-api output
does not change. The README, CHANGELOG, crate summary and description,
and the Makefile feature and MSRV lanes cover the new feature.

The README, the module docs, and the CHANGELOG state the same
compatibility policy. While `spiffe` is pre-1.0, a breaking change to
`broker-api` requires a minor version bump, and patch releases stay
compatible.

Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>

144 of 149 new or added lines in 1 file covered. (96.64%)

7431 of 8426 relevant lines covered (88.19%)

701.61 hits per line