Enum TrustDomainPolicy 

pub enum TrustDomainPolicy {
    AnyInBundleSet,
    AllowList(BTreeSet<TrustDomain>),
    LocalOnly(TrustDomain),
}

Policy for selecting which trust domains to trust during certificate verification.

When SPIFFE federation is configured, the Workload API delivers trust bundles for multiple trust domains. This policy allows you to restrict which of those bundles are actually used during certificate verification.

This is a defense-in-depth mechanism. The primary trust model comes from the bundle set delivered by the SPIFFE Workload API. This policy provides an additional layer of control over which trust domains are accepted.

Default: AnyInBundleSet - use all bundles provided by the Workload API.

Examples

use spiffe_rustls::{AllowList, AnyInBundleSet, TrustDomainPolicy};
use std::collections::BTreeSet;

// Default: trust any domain in the bundle set
let policy = AnyInBundleSet;

// Restrict to specific trust domains (using re-exported variant)
let mut allowed = BTreeSet::new();
allowed.insert("broker.example".try_into().unwrap());
let policy = AllowList(allowed);

// You can also use the full path if preferred
let policy = TrustDomainPolicy::default();

Variants

AnyInBundleSet

Default: use all trust domain bundles provided by the Workload API.

When SPIFFE federation is configured, the Workload API delivers bundles for multiple trust domains. This policy accepts all of them, allowing the verifier to automatically select the correct bundle based on the peer’s SPIFFE ID. No additional configuration is needed for federation to work.

AllowList(BTreeSet<TrustDomain>)

Restrict to these trust domains only.

Only bundles for these trust domains will be used, even if other bundles are present in the bundle set.

LocalOnly(TrustDomain)

Only trust the specified trust domain.

Only bundles for this trust domain will be used, even if the Workload API provides bundles for other trust domains. This restricts certificate verification to a single trust domain.

Implementations

impl TrustDomainPolicy

pub fn allows(&self, trust_domain: &TrustDomain) -> bool

Checks if a trust domain is allowed by this policy.

Trait Implementations

impl Clone for TrustDomainPolicy

fn clone(&self) -> TrustDomainPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TrustDomainPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TrustDomainPolicy

fn default() -> TrustDomainPolicy

Returns the “default value” for a type.