Server Workload Attestation Examples

These examples implement an HTTPS webhook that the Trust Domain Server calls each time it issues an SVID. Your webhook receives the attributes collected during workload attestation and returns custom attributes, or an error that refuses the identity.

Reach for this surface when the data or the decision lives in a central system — a CMDB, an asset inventory, a service catalog, a policy engine. The webhook runs on the server, so nothing is installed on agent hosts and no node needs access to those systems.

Reference: Server Workload Attestation Extension, for configuration fields, the wire protocol, retry behavior, filtering, and troubleshooting.

If the input you need is host-local instead, such as hardware present on the node or the workload's own binary, see Agent Workload Attestation Examples. To compare all four extension points, see Which extension do you need?.

📄️Add Custom Attributes

Enrich SVIDs with data from your own systems.

📄️Deny SVID Issuance

Reject workloads with a server-side webhook.

📄️Registration Entries

Assign SPIFFE ID paths from a registration list.