WIT-SVID Configuration

WIT-SVID issuance is configured as a peer to X.509 and JWT inside your SVIDIssuancePolicy managed configuration. Add a wit block under policy.

section: SVIDIssuancePolicy
schema: v1
spec:
  policy:
    pathTemplate: "/workload/{{linux.binary.name}}"
    wit:
      ttl: 1h
      # Optional claim templates merged into the WIT, using the same
      # {{attribute.ref}} syntax as JWT-SVID additional claims.
      additionalClaims:
        team: "{{linux.user.name}}"

Apply it with spirlctl:

spirlctl config set cluster --id <cluster-id> svid-issuance-policy.yaml

Or with Terraform:

resource "spirl_cluster_config" "svid_issuance_policy" {
  cluster_id = spirl_cluster.my_cluster.id
  sections = {
    SVIDIssuancePolicy = <<-YAML
      section: SVIDIssuancePolicy
      schema: v1
      spec:
        policy:
          pathTemplate: "/workload/{{linux.binary.name}}"
          wit:
            ttl: 1h
            additionalClaims:
              team: "{{linux.user.name}}"
    YAML
  }
}

WIT policy fields

Field	Required	Notes
ttl	No	WIT-SVID lifetime. Minimum 1 hour, maximum 7 days. Defaults to 24 hours when omitted.
additionalClaims	No	Extra claims merged into the WIT. This uses the same {{attribute.ref}} templating as JWT-SVID additional claims.

Reserved claims

Custom additionalClaims cannot override the server-managed claims. These names are rejected at configuration time: iss, sub, aud, exp, nbf, iat, jti, and cnf.

Two of these matter especially for WIT-SVIDs: cnf carries the proof-of-possession binding and may never be operator-supplied, and aud is prohibited on a WIT-SVID entirely.

To apply different WIT settings to specific workloads within the same cluster, use per-workload overrides.

Next, fetch a WIT-SVID from your workload.