SPIFFE secrets engine

The spiffe secrets engine allows for minting SPIFFE JWT-SVIDS using a template that can interpolate identity information about the requesting entity. Since the JWTs are OIDC-compatible, you can use them like JWT tokens minted using the identity engine.

Configuration

Each SPIFFE backend instance has a single trust domain. The plugin uses roles to define templates that determine the claims in the minted JWTs.

Integrate with SPIRE

The SPIFFE secrets engine has an endpoint trust_bundle/web that serves the trust bundle. Clients can call the trust endpoint to fetch the public keys needed to validate JWTs minted by the plugin. Compatible clients include any system that implements SPIFFE federation for example, SPIRE or another Vault cluster running the SPIFFE auth method.

Integrate with OIDC

The SPIFFE secrets engine includes two endpoints that allow OIDC providers to validate the JWTs it mints:

• .well-known/openid-configuration
• .well-known/keys .

SPIFFE secrets engine API

The SPIFFE secrets engine has a full HTTP API. Refer to the SPIFFE secrets engine documentation for more details.