Everyone’s Starting to Look SPIFFE: MTLS and Identity with Linkerd & Teleport
summary
Linkerd and Teleport are wired to use SPIFFE SVIDs so Linkerd’s mesh expansion can mTLS to workloads outside Kubernetes; a demo uses k3d, Linkerd CRDs, tbot providing Workload API SVIDs and external proxies. Integration mostly works but uncovers concrete gaps: Linkerd rejects RSA-signed certs requiring an RSA vs ECDSA mismatch, Teleport omits X.509 subject by default, some APIs assume Spire, and setting up took 3.5 weeks with the demo reaching about two thirds completion.
AI-written summary · about
chapters (12)
- 0:00SPIFFE introduction
- 1:42What is SPIFFE
- 3:51Linkerd identity overview
- 5:16Teleport identity & access
- 7:23SPIFFE with Linkerd & Teleport
- 9:07Teleport with Linkerd goals
- 11:56Demo architecture setup
- 14:44Live demo troubleshooting
- 20:47Integration challenges
- 27:04Lessons learned
- 31:02SPIFFE adoption value
- 31:23Q&A
related talks
32mSecuring Communication Between Meshes and Beyond with SPIFFE Federation
29mBridging the Great Divide: SPIFFE/SPIRE for Cross-Cluster Authentication
37mSPIFFE Deep Dive
49mReal World SPIFFE Scenarios and Outcomes
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
07m⚡ Lightning Talk: Using Istio and SPIRE to Trust Cross-domain Traffic in Hybrid Cloud Scenarios
36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
32mA Platform-Agnostic Approach to Securing Workloads