Zero Trust Workload Identity in Kubernetes
summary
Explains how SIFFE identity and the Spire runtime replace shared secrets with workload-bound x509/JWT credentials, issuing short-lived SVIDs that agents rotate and expose via a node-local Workload API. Describes Spire agents as daemonset agents attesting nodes (AWS plugin example) and workloads, integrating with Vault for secret access, Istio/Envoy via SDS, Tekton build signing, Sigstore keyless signing and verification, and Keylime hardware TPM attestation so only verifiably measured nodes get identities.
AI-written summary · about
chapters (13)
- 0:00Start
- 0:54Zero Trust?
- 5:42SPIRE?
- 18:35SPIFFE + Vault
- 20:32SPIFFE + Databases
- 21:40Service Mesh?
- 24:56Software Supply Chain?
- 26:10Tekton?
- 26:58SPIFFE + Tekton
- 29:28Sigstore?
- 30:28SPIFFE + Sigstore
- 33:34Keylime?
- 34:56SPIFFE + Keylime
related talks
32mProduction Workload Identity with SPIRE
36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
33mUniform Workload Identity Everywhere: SPIRE Integrations and Extensibility
30mIntro: SPIFFE
04mSecurely Bridging Cloud-Native and Traditional Workloads...
32mA Platform-Agnostic Approach to Securing Workloads
36mSecuring Agentic Platforms with Zero-Trust Workload Identities
36mFederated Identity for Distributed Systems: Understanding SPIFFE