fenced-svid

Overview ¶

Command fenced-svid generates the X.509-SVID identity material for the Secure Runtime boundary (ADR-011): a self-signed SPIFFE CA, a control plane SVID (with loopback IP SAN), and one worker SVID per runtime instance.

Usage:

fenced-svid -out ./svid -tenant tenant-a -worker worker-1 [-worker worker-2 ...]

The trust bundle is ca.pem. The control plane runs with control-cert.pem / control-key.pem and -trust-bundle ca.pem; each worker runs with worker-<id>-cert.pem / worker-<id>-key.pem. For production, rotate the CA through a real CA process and keep private keys in a secret manager; the trust bundle is the same PEM file distributed to every boundary.