broker

type AllowedReferenceType struct {
	// TypeURL is the verbatim protobuf type URL. The wildcard `"*"` allows
	// any reference type.
	TypeURL string

	// AllowOverTCP permits this reference type over TCP. When false, the
	// reference type is only allowed over UDS.
	AllowOverTCP bool
}

type Broker struct {
	// ID is the SPIFFE ID of the broker. Cross-trust-domain broker
	// identities are allowed.
	ID string

	// AllowedReferenceTypes restricts which WorkloadReference types this
	// broker is permitted to use. Each entry is the verbatim protobuf type
	// URL the workload attestor plugin matches against (e.g.
	// `type.googleapis.com/spiffe.broker.KubernetesObjectReference`). Use
	// `"*"` to allow any reference type this agent's workload attestor stack
	// understands. Must list at least one entry.
	AllowedReferenceTypes []AllowedReferenceType
}

type Config struct {
	// BindAddrs are the addresses the endpoint listens on. Each may be a
	// `*net.UnixAddr` or a `*net.TCPAddr`; the same gRPC server (and same
	// mTLS configuration) is fanned out across all of them.
	BindAddrs []net.Addr

	Manager manager.Manager

	Log logrus.FieldLogger

	Metrics telemetry.Metrics

	Attestor attestor.Attestor

	// Brokers enumerates the brokers authorized to talk to this endpoint.
	// mTLS at the listener gates the set; brokers absent from it are
	// rejected at the TLS layer.
	Brokers []Broker

	SVIDSource   x509svid.Source
	BundleSource x509bundle.Source

	// TLSPolicy controls the post-quantum-safe TLS policy applied to the
	// inbound mTLS listener.
	TLSPolicy tlspolicy.Policy
}

type Endpoints struct {
	// contains filtered or unexported fields
}