Skip to content

Commit

Permalink
Updated language regarding node attestation
Browse files Browse the repository at this point in the history
Signed-off-by: Quintessence <[email protected]>
  • Loading branch information
quintessence committed Apr 20, 2024
1 parent f9b1afc commit 1816c99
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion content/docs/latest/spire-about/spire-concepts.md
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@ This bootstrap bundle is a default configuration, and should be replaced with cu
{{< /warning >}}
8. The server calls the AWS API to validate the proof.
9. AWS acknowledges the document is valid.
10. The server performs node resolution, to verify additional properties about the agent node and update its registration entries accordingly. For example, if the node was attested using Microsoft Azure Managed Service Identity (MSI), then the resolver extracts the Tenant ID and Principal ID from the agent SPIFFE ID and uses the various Azure services to get information for building an additional set of selectors.
10. The server performs additional attestation steps to verify further properties about the agent node and update its registration entries accordingly. For example, if the node was attested using an AWS Instance Identity Document (IID), the attestor will perform AWS API requests to get further information for building an additional set of selectors, e.g. autoscale group or instance tag information.
11. The server issues an SVID to the agent, representing the identity of the agent itself.
12. The agent contacts the server (using its SVID as its TLS client certificate) to obtain the registration entries it is authorized for.
13. The server authenticates the agent using the agent's SVID. The agent, in turn, completes the mTLS handshake and authenticates the server using the bootstrap bundle.
Expand Down

0 comments on commit 1816c99

Please sign in to comment.