Fortifying gRPC Microservices: Beyond JWT with mTLS and SPIFFE
summary
Argues that replacing JWT with mTLS+SPIFFE removes token headaches by issuing per-workload certificates via a Spire agent and a central Spire server that manages trust bundles, with the grpc process calling the workload API for creds; notes one-month cert lifetimes that are monthly certs renewed biweekly to avoid mass expiry, patches to gRPC core to support hot reload actually worked, and warns on-prem environments are harder because node attestation is nontrivial.
AI-written summary · about
chapters (9)
- 0:00Securing gRPC microservices
- 1:03Service-to-service security
- 4:18API keys and tokens limits
- 6:54Why mTLS for gRPC
- 7:58Traditional mTLS problems
- 11:31SPIFFE for identity
- 13:19SPIRE implementation
- 16:58Simplify mTLS with SPIRE
- 17:42Q&A on SPIFFE/SPIRE
related talks
31mAuthentication and Security in gRPC Microservices
32mA Platform-Agnostic Approach to Securing Workloads
36mFederated Identity for Distributed Systems: Understanding SPIFFE
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
37mSPIFFE Deep Dive
33mSPIFFE and SPIRE: Architecture Deep Dive
28mCan I Trust You? Service-to-Service Identity with SPIFFE
30mIntro: SPIFFE