Rust SDK - Workload identity

​

Enabling WIF

use westyx_nexus::{NexusClient, NexusConfig, WifConfig};

let client = NexusClient::create(NexusConfig {
    endpoint: std::env::var("NEXUS_ENDPOINT")?,
    wif: Some(WifConfig {
        enabled: true,
        // `credential` defaults to WifProvider::Auto - auto-detect from the
        // environment. Name one explicitly with
        // `credential: WifProvider::Kubernetes.into()`.
        ..Default::default()
    }),
    ..Default::default()
})
.await?;

​

Provider auto-detection

​

Token sources

​

Session lifecycle

• Refreshed pre-emptively, about 60 s before expiry.
• The SSE auth_expiring event forces a refresh. The backend sends it about five minutes ahead, so a non-forced refresh would decline to act.
• A 401 forces one refresh and retries the request once, so a client whose local clock disagrees with the server re-authenticates instead of repeating a rejected token.
• Concurrent refreshes are de-duplicated - callers share one in-flight exchange.
• A failed refresh fails closed: never a stale bearer, never an empty API-key header. A static API key is used as a fallback only if you explicitly configured one alongside WIF.
• expires_in is clamped - a missing, zero or negative value is floored so a fresh session is not immediately “expiring”, and an absurd value is capped at 24 h.

​

Developer credentials

• Matched on the endpoint host and non-default port. Scheme and a trailing slash are ignored; the host identifies the service and a non-default port distinguishes two on the same host (a default :443 is normalised away, so writing it or omitting it matches the same entry).
• No token exchange happens. The CLI already performed it, so the session token goes straight through. No Keycloak refresh token is read, stored or sent.
• Probed last. A live GCE metadata server or an AKS projected token always wins, so the same binary on real cloud compute uses the real workload identity.
• Re-read on every refresh, so running westyx dev setup again mid-run takes effect without a restart.
• An expired entry is refused with a message naming westyx dev setup --service=<name> - never sent, never silently skipped.
• A file readable by other local users is refused, with a message naming the chmod that fixes it.

​

Supplying the credential yourself

use westyx_nexus::{WifConfig, WifCredential, blocking_token_source};

// A synchronous closure, adapted onto the blocking pool:
WifConfig {
    enabled: true,
    credential: WifCredential::Source(blocking_token_source(|| {
        Ok(std::fs::read_to_string("/var/run/my-token")?.trim().to_string())
    })),
    ..Default::default()
}

​

Metadata client hardening

​

AWS IAM (non-EKS AWS compute)

westyx-nexus = { version = "0.14.0-beta.2", features = ["aws-iam"] }

WifConfig {
    enabled: true,
    credential: WifProvider::AwsIam.into(),
    aws_region: Some("eu-central-1".into()), // optional - defaults to the AWS chain
    ..Default::default()
}

​

Token exchange contract

​

Configuration errors caught at construction

• aws_region set with any credential other than WifProvider::AwsIam. The region is used only by that provider, which is never auto-detected - so setting it under Auto did nothing at all.
• WifProvider::AwsIam selected without the aws-iam cargo feature.