bobbylite / bobbylite/service-template
Wire SPIFFE/SPIRE workload identity
- Dominant language
- Python
- Stars
- 0
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
Replace NullIdentityProvider in src/app/identity/provider.py with a real implementation backed by py-spiffe (spiffe.WorkloadApiClient or spiffe.X509Source), fetching SVIDs from the SPIRE Workload API socket (SPIFFE_ENDPOINT_SOCKET env var). Routes and MCP tools should keep depending on the IdentityProvider protocol, not SPIFFE directly.
Contributor guide
No contributing guide indexed for this repository
Research direction
The work is in src/app/identity/provider.py, replacing NullIdentityProvider. Start by reading the existing provider protocol and the py-spiffe documentation for WorkloadApiClient or X509Source. The SPIFFE endpoint is configured via the SPIFFE_ENDPOINT_SOCKET environment variable. Ensure routes and MCP tools continue to use the IdentityProvider interface without direct SPIFFE dependencies. Test by running the service and verifying identity provisioning works.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, backend, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 65/100