SPIFFE workload identity

Admits SPIFFE-identified workloads from trusted domains only, and grants each one entitlements by its SPIFFE path.

• Control id: spiffe_policy
• Shape: grant. Segment bindings do not reach this control, because its Rego does not read settings through pbac.segments.settings.
• Entry points: token
• Phases: token_exchange

Policy data

pbac.operator.controls.spiffe_policy

• Role: operator
• Written by: operator
• Schema: src/main/resources/schemas/operator-spiffe-policy.v1.json

Setting	Type	Default
trust_domains	array of string	none in the schema
path_grants	object	none in the schema

Reads

• context.client.registration_type
• context.actor.spiffe.trust_domain

Emits

• deny
• reason
• granted_resources
• expires_in_override
• jit_single_use

Reason codes

Code	Category	Entry point	Setting
spiffe_untrusted_domain	control	token	pbac.operator.controls.spiffe_policy#trust_domains
spiffe_no_path_grants	control	token	pbac.operator.controls.spiffe_policy#path_grants

Implementation

Kind	Reference	Files	Role
rego_package	pbac.controls.spiffe	opa/policies/pbac/controls/spiffe.rego	decides
rego_package	oauth.spiffe	opa/policies/oauth/spiffe.rego	decides
rego_fragment	oauth.client_entitlements	opa/policies/oauth/client_entitlements.rego	decides