Federated Identity for Distributed Systems: Understanding SPIFFE
summary
Claims that SPIFFE replaces long‑lived secrets with short‑lived cryptographic identities, issues X.509 and JWT credentials via a workload API, and uses node attestation as the bootstrap for the trust anchor. Demo builds a SPIRE server + agent on Kubernetes, mounts agent sockets into pods via a CSI driver, mints certificates validated with OpenSSL and exchanges trust bundles; TLS demo succeeds, JWT demo partly fails. Tokens default to about 4 hours and are configurable.
AI-written summary · about
chapters (8)
- 0:00Introduction and speaker background
- 1:11Drivers for federated identity
- 8:42Challenges in distributed systems
- 13:18What is SPIFFE
- 20:59SPIFFE demo setup
- 26:00X.509 certificate demo
- 30:23JWT token demo
- 34:31Q&A and summary
related talks
28mCan I Trust You? Service-to-Service Identity with SPIFFE
36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
30mIntro: SPIFFE
49mReal World SPIFFE Scenarios and Outcomes
41mSPIFFE Project Intro
36mSPIFFE: In Theory and in Practice
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
33mSPIFFE and SPIRE: Architecture Deep Dive