Module workload 

Platform workload identity: RFC 7523 JWT-bearer assertions signed with a Cloud Foundry instance identity certificate.

Cloud Foundry gives every app instance an X.509 certificate and RSA key (paths in CF_INSTANCE_CERT and CF_INSTANCE_KEY), rotated before they expire. The certificate’s subject names the instance (CN) and, in OU values, its app:<guid>, space:<guid>, and organization:<guid>.

An app (or the AgentVisor sidecar beside it) proves that identity by sending /v1/token an RFC 7523 assertion (grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer): a short-lived JWT signed RS256 with the instance key, whose x5c header carries the instance certificate and its intermediates. WorkloadTrust::verify checks, in order:

1. size, JOSE header (alg = RS256, 1 to 4 x5c certificates);
2. the certificate chain up to a configured instance-identity root, valid now, with the clientAuth extended key usage;
3. the assertion signature with the certificate’s key;
4. the claims: aud names the gateway, sub is the instance GUID, the lifetime is at most MAX_ASSERTION_LIFETIME_S, and jti is present;
5. jti was not seen before (a bounded replay cache).

The caller then maps the verified identity to a configured workload, which names the human principal the agent acts for, and issues a gateway-signed agent token.

Structs

CfInstanceIdentity

The platform identity proven by a verified assertion.

VerifiedAssertion

A verified assertion.

WorkloadTrust

Trusted instance-identity roots plus the replay cache.

Enums

WorkloadError

Why an assertion was refused.

Constants

JWT_BEARER_GRANT_TYPE

RFC 7523 §2.1 grant type.

MAX_ASSERTION_LIFETIME_S

Longest accepted assertion lifetime (exp - iat), in seconds.

Functions

cf_identity

Read a Cloud Foundry instance identity out of an X.509 subject name.

name_attributes

(attribute OID, text) pairs of an X.509 Name, given the contents of its outer SEQUENCE. String types other than UTF8String, PrintableString, and IA5String are skipped.

tlv

Split one DER TLV off the front of input: (tag, value, rest).