Agnostic Workload Identity Across the Argo Ecosystem Using SPIFFE...
summary
Demonstrates integrating SPIFFE/SPIRE SVIDs into the Argo ecosystem to replace long‑lived repo secrets: a prototype fetches short‑lived credentials via a token exchange flow, exchanges a SPIFFE JWT for Quay repo tokens in a demo that pulls a private guestbook, and proposes a PR to Argo CD to fetch credentials just‑in‑time so nothing lives in the argocd namespace. Shows gaps today (only Azure has repo support), explains per-project SPIFFE IDs, and argues it scales to multi‑cluster and on‑prem.
AI-written summary · about
chapters (14)
- 0:00Workload identity in Argo
- 1:01Secrets in GitOps problems
- 3:09Workload identity importance
- 4:56SPIFFE and SPIRE explained
- 6:41Argo workload identity support
- 8:26Argo workload identity gaps
- 9:27Future of Argo CD identity
- 11:16Native identity for Argo CD
- 15:52Per-project SPIFFE identity
- 18:43Token exchange for repo access
- 20:09SPIFFE integration demo
- 23:26Next steps for identity
- 24:49Resources and community
- 25:15Q&A
related talks
40mMulti-Cloud Workload Identity With SPIFFE
36mFederated Identity for Distributed Systems: Understanding SPIFFE
26mSPIFFE in Practice: Universal Identity for WebAssembly Workloads
30mAdvancing Machine to Machine Workflows with the SPIFFE Identity Provider
36mSPIFFE: In Theory and in Practice
30mIntro: SPIFFE
36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
34mDon't Mind the Gap: Securely Accessing Cloud Resources From Anywhere With SPIFFE/SPIRE