Secrets Distribution Service  ·  View 07 of 34  ·  3 · Structure

Layered Architecture

Eight layers from the workload down to the hardware root and across to the record. Trust flows up, calls flow down, and governance is never on the request path.

Editable source SVG draw.io All views
Workloads Services Kubernetes Batch and CI ephemeral pods Legacy processes unmodifiable Delivery Local socket default mode tmpfs file 0400 · pod UID Credential proxy Envoy · HTTP only Node Credential agent Go · memory only SPIRE agent delegated identity Issuance Issuance gateway bind · check · audit SPIRE server trust domain per env Engines Broker shards OpenBao · leases Custody OpenBao · KV v2 · transit Root of trust KMS cluster key custodians HSM pair PKCS#11 seal Governance Registry Git · reviewed Inventory blast radius Rotation controller Reconciler hourly Access broker break-glass Record Audit stream Kafka · acks=all Audit query ClickHouse · 400 d Audit archive Ceph Object Lock · 7 y Layered Architecture — Eight Layers, One Direction of Trust External / third party Interface / broker Application we own Security / platform Data store Queue / topic A layer calls the layer below it, never above. Governance writes policy into the engines and is never on the issuance path. v 1.0 · owner Security Platform Architecture · date 2026-09

Decisions

  • Delivery is its own layer. The same agent serves a socket, a tmpfs file or a proxy, so moving a workload between modes (or a secret from custody to brokered) changes no application code.
  • The root of trust sits below the engines and is run by a different team. The engines can use keys; they cannot export, rotate or destroy them.
  • Governance writes policy ahead of time and is not consulted during a request. A governance outage stops change, never issuance.

Build or adopt

  • Adopted: SPIRE, OpenBao, Envoy, Kafka, ClickHouse, Ceph, Keycloak, Forgejo. Built: the issuance gateway, the credential agent, the registry compiler, the rotation controller, the reconciler and the access broker. Every built piece is small, and each exists because an adopted one cannot enforce a requirement (ADR-08).

Omitted here

  • Observability and delivery tooling are on views 26 and 27.
◀  Journey — Rotate Past a Straggler All views One Node and Its Delivery Modes  ▶
Solution Architecture v1.0 · Security Platform Architecture · 2026-09 · 34 views · open source, fully on-premises07-layered-architecture