Struct ClientConfigBuilder 

pub struct ClientConfigBuilder { /* private fields */ }

Builds a rustls::ClientConfig backed by a live SPIFFE X509Source.

The resulting client configuration:

• presents the current SPIFFE X.509 SVID as the client certificate
• validates the server certificate chain against the trust domain bundle
• authorizes the server by SPIFFE ID (URI SAN)

The builder retains an Arc<X509Source>. When the underlying SVID or trust bundle is rotated by the SPIRE agent, new TLS handshakes automatically use the updated material.

Authorization

Server authorization is performed by invoking the provided AuthorizeSpiffeId hook with the server’s SPIFFE ID extracted from the certificate’s URI SAN.

Use ClientConfigOptions::allow_any to disable authorization while retaining full TLS authentication.

Implementations

impl ClientConfigBuilder

pub fn new(source: Arc<X509Source>, opts: ClientConfigOptions) -> Self

Creates a new builder from an X509Source and options.

pub fn build(self) -> Result<ClientConfig>

Builds the rustls::ClientConfig.

The returned configuration:

• presents the current SPIFFE X.509 SVID as the client certificate
• validates the server certificate chain against the configured trust domain
• authorizes the server by SPIFFE ID (URI SAN)

The configuration is backed by a live X509Source. When the underlying SVID or trust bundle is rotated by the SPIRE agent, new TLS handshakes automatically use the updated material.

Errors

Returns an error if:

• the Rustls crypto provider is not installed
• no current X.509 SVID is available from the X509Source
• the trust bundle for the configured trust domain is missing
• building the underlying Rustls certificate verifier fails

Trait Implementations

impl Debug for ClientConfigBuilder

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.