Secrets Distribution Service  ·  View 02 of 34  ·  1 · Context and scope

High-Level Architecture

Six stages from a pod with nothing in it to a credential that expires, and the record that outlives both.

Editable source SVG draw.io All views
Workload Workload pod no secret in image Node SPIRE agent attests pod Credential agent memory only Issuance tier SPIRE server per-site intermediate Issuance gateway stateless · Go Engines Broker OpenBao · leases Custody OpenBao · ciphertext Roots and upstreams Upstreams accounts · keys KMS OpenBao · HSM seal Record Audit stream Kafka Audit store ClickHouse · Object Lock socket · file delegated SVIDs node attest mTLS · session mint · renew read ciphertext create · drop unwrap sealed High-Level Architecture — From Attestation to Expiry External / third party Security / platform Application we own Interface / broker Queue / topic Data store synchronous batch event / async Every arrow into the gateway carries an attested identity. No arrow anywhere carries a credential used to obtain a credential. v 1.0 · owner Security Platform Architecture · date 2026-09

Decisions

  • Attestation comes first and is a separate product. SPIRE turns what the infrastructure knows about a pod into a short-lived identity; nothing downstream accepts anything else.
  • Brokerage and custody are separate engines. A minted database account and a partner's API key have different lifecycles, different failure modes and different guarantees, so they do not share a cluster, a key or a promise.
  • The gateway is the only door. It is stateless and small, and it holds the checks that must precede any policy: environment, key binding, restore generation, admission and audit posture.

Why this shape lasts

  • Each stage speaks a standard: SPIFFE for identity, the OpenBao API for engines, SQL and admin APIs for upstreams, Kafka for the record. Any one can be replaced without renegotiating the others.

Read next

  • The chain of trust is view 10. The checks inside the gateway are view 12. How the audit record is kept is view 15.
◀  System Context All views Actors and Their Journeys  ▶
Solution Architecture v1.0 · Security Platform Architecture · 2026-09 · 34 views · open source, fully on-premises02-high-level-architecture