Enum PlatformIdentity 

#[non_exhaustive]
pub enum PlatformIdentity {
    KubernetesServiceAccount {
        namespace: String,
        service_account: String,
        pod: Option<String>,
    },
    Spiffe {
        trust_domain: String,
        name: String,
        version: String,
    },
    Shared {
        name: String,
    },
    OutboundMarker,
    Unknown,
}

Method-agnostic platform identity produced by validating an InternalCredential.

The variant reflects which credential authenticated the caller; platform handlers consume a PlatformSecurityContext without branching on it. New authentication methods add a variant — hence #[non_exhaustive] — without changing PlatformSecurityContext’s shape.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

KubernetesServiceAccount

First phase: a validated K8s ServiceAccount (from a projected SA token verified via the TokenReview API).

Fields

namespace: String

Namespace the ServiceAccount belongs to.

service_account: String

ServiceAccount name.

pod: Option<String>

Originating pod name, when the token review reports it.

Spiffe

Next phase: an mTLS + SPIFFE workload identity parsed from the X.509 SAN (spiffe://<trust_domain>/gear/<name>/<version>). Reserved — not populated in the first phase.

Fields

trust_domain: String

SPIFFE trust domain.

name: String

Workload name component of the SPIFFE ID (the gear segment of spiffe://<trust_domain>/gear/<name>/<version>).

version: String

Version component of the SPIFFE ID.

Shared

A caller authenticated by a pre-shared secret (dev / single-node profiles). Not tied to any deployment substrate: it exists so the platform plane can be exercised end-to-end without Kubernetes. The name is a configured label used for workload-policy decisions.

Fields

name: String

Configured caller label (returned by PlatformIdentity::peer_name).

OutboundMarker

A credential-free outbound plane marker, not an authenticated caller.

Produced only by PlatformSecurityContext::outbound_marker, so gear code can satisfy a platform-plane signature without possessing a real identity. It is never the result of validating anything, and must never authorize anything.

It has its own variant because it used to share Self::Unknown, leaving one value meaning two unrelated things — a locally minted marker and a peer identity this build does not recognise — with peer_name() answering "<unknown>" for both.

Unknown

Catch-all for variants introduced in a newer library version.

Produced only by serde::Deserialize when the "type" field holds an unrecognised value; peer_name returns "<unknown>" for it.

It no longer doubles as the outbound marker — see Self::OutboundMarker.

Implementations

impl PlatformIdentity

pub fn peer_name(&self) -> &str

The caller’s name, distilled for workload-policy decisions.

For a PlatformIdentity::KubernetesServiceAccount this is the ServiceAccount name; for PlatformIdentity::Spiffe it is the workload (gear) component of the SPIFFE ID.

Trait Implementations

impl Clone for PlatformIdentity

fn clone(&self) -> PlatformIdentity

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PlatformIdentity

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for PlatformIdentity

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for PlatformIdentity

impl PartialEq for PlatformIdentity

fn eq(&self, other: &PlatformIdentity) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for PlatformIdentity

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for PlatformIdentity