Replace NODE_UID with the node's UID: changedmanage-claude/wif-providers/spiffe
Nearest release: v2.1.318, published 17 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+2added
Lines−2removed
From line
87
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits19to this page, all time
The whole hunk
from line 87, old and new numbered
/
from line 87
8787
8888Each workload that calls the Claude API needs a SPIRE registration entry that maps its runtime selectors to a SPIFFE ID. If the workload is already registered, note its SPIFFE ID, which you use in the federation rule’s `subject_prefix`. If not, register it. For a Kubernetes pod, the selectors are typically the namespace and Kubernetes service account:
8989
90```bash CLI
90```bash
9191# Replace NODE_UID with the node's UID:
9292# kubectl get node <node-name> -o jsonpath='{.metadata.uid}'
9393spire-server entry create \
from line 457
457457 The Workload API attests the calling process. For a Kubernetes registration entry, run this command inside a pod that satisfies the entry’s selectors and has the agent socket mounted (for example, by using `kubectl exec`). On VMs and bare metal, run it as the user or process that matches the entry’s `unix:` selectors. Running from an unattested host shell returns `no identity issued`, which is the most common verify-step failure.
458458</Note>
459459
460```bash CLI
460```bash
461461spire-agent api fetch jwt \
462462 -audience https://api.anthropic.com \
463463 -socketPath /run/spire/sockets/agent.sock \
No line in this hunk matches that.