feat(spiffe): JWT-SVID signing endpoint (RFC UAA-SPIFFE-001)#3968

Draft

rkoster wants to merge 9 commits into

cloudfoundry:developfrom

rkoster:spiffe-signer

Commits on Jun 26, 2026

feat(spiffe): add SpiffeProperties config binding
rkoster
committed
feat(spiffe): add SpiffeId formatter and CfInstanceIdentity record
rkoster
committed
feat(spiffe): parse org/space/app GUIDs from instance cert OUs
rkoster
committed
feat(spiffe): verify instance cert against configured CA and validity
rkoster
committed
feat(spiffe): verify proof-of-possession signature and freshness
rkoster
committed
feat(spiffe): sign JWT-SVID with UAA active key and OIDC issuer
rkoster
committed
feat(spiffe): add JWT-SVID signing endpoint and DTOs
rkoster
committed
feat(spiffe): wire SPIFFE properties, CA bean, and security chain
rkoster
committed
fix(spiffe): validate jwt-svid request inputs and lock fail-closed paths
rkoster
committed