pub struct SignedClusterJoinToken {
pub v: u32,
pub kid: String,
pub claims: ClusterJoinClaims,
pub sig: String,
pub ca_chain: Option<CaCert>,
}Expand description
Envelope around ClusterJoinClaims carrying the Ed25519 signature.
On the wire, this struct is serialized as JSON and then base64 url-safe-no-pad encoded. The Wave 3.2 mint function produces that outer base64; the parser reverses it.
Fields§
§v: u32Format version. 1 in Wave 3. Wave 9 will introduce v=2 (adds
a ca_chain field for federated trust); parsers MUST reject any
version they don’t understand.
kid: StringKey identifier (first 8 hex chars of SHA-256 over the verifying key bytes). Lets joining nodes pick the correct pubkey during rotation (Wave 5).
claims: ClusterJoinClaimsThe payload that’s actually signed.
sig: StringEd25519 signature over serde_json::to_vec(&claims), encoded as
URL-safe no-pad base64.
ca_chain: Option<CaCert>Optional CA chain binding the kid to a foreign cluster. Set
to Some(...) only on v=2 tokens minted for cross-cluster
federation; same-cluster v=2 tokens may omit it. v=1 tokens
MUST have this field absent (skip_serializing_if guarantees the
JSON shape stays compatible with v=1 parsers).
Trait Implementations§
Source§impl Clone for SignedClusterJoinToken
impl Clone for SignedClusterJoinToken
Source§fn clone(&self) -> SignedClusterJoinToken
fn clone(&self) -> SignedClusterJoinToken
1.0.0 (const: unstable) · Source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source. Read more