Skip to main content

Agent Workload Attestation Examples

These examples implement an executable that runs on every agent host. When a workload requests an SVID, the agent passes it the collected attributes over stdin and reads custom attributes back over stdout, or an error that fails attestation.

Reach for this surface when the input is host-local and cannot be seen from anywhere else — hardware present on the node, a file on disk, the workload's own binary. The executable runs beside the workload, so no network call is needed on the issuance path.

Reference: Agent Workload Attestation Extension, for configuration fields, the stdin and stdout protocol, and troubleshooting.

Two constraints are specific to this surface. The executable runs for every workload on the node, with no cluster or attribute filter, and installing it means getting a binary onto each host. If the data you need comes from a central system instead, a webhook avoids both. See Server Workload Attestation Examples. To compare all four extension points, see Which extension do you need?.