The Story of Crush: The Microservice That Navigated the Cloud Native O...
summary
A runnable Go microservice uses a SPIFFE SVID from SPIRE (Kubernetes on GCP) to establish mTLS with a backend, and demos show short‑lived X.509 certs (≈5‑hour TTL), a rogue instance rejected, and Envoy as an Envoy sidecar performing SDS-based mTLS + URI SAN authorization. Workarounds include a spiffe‑helper sidecar to surface cert files for Postgres (CN‑only validation) and an init container that runs a credential process to mint a JWT SVID and assume an AWS role via OIDC for S3 access.
AI-written summary · about
chapters (7)
- 0:00Introduction to the story
- 1:24Understanding SPIFFE/SPIRE
- 5:17SPIFFE native communication
- 7:52Envoy proxy integration
- 14:29JWT federation for S3
- 20:08Hybrid service connectivity
- 30:11Conclusion and wrap up
related talks
40mMulti-Cloud Workload Identity With SPIFFE
32mFive Things You Didn’t Know You Could Do with SPIFFE and SPIRE
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
29mBridging the Great Divide: SPIFFE/SPIRE for Cross-Cluster Authentication
28mCan I Trust You? Service-to-Service Identity with SPIFFE
49mReal World SPIFFE Scenarios and Outcomes
36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
07m⚡ Lightning Talk: Using Istio and SPIRE to Trust Cross-domain Traffic in Hybrid Cloud Scenarios