Real World SPIFFE Scenarios and Outcomes

on YouTube ↗49m

" summary

SPIFFE provides short‑lived X.509 workload identity with one-hour certificates and automated rotation, implemented by SPIRE and consumed by Envoy, Istio and AWS App Mesh; deployments at GitHub, Uber, Square and TikTok show global scale from dozens to millions of hosts. SPIRE ties into cloud KMS integration and hardware attestation (TPM/SGX) to revoke signing keys and prove node integrity. Federation remains work in progress via a proposed federation API to enable cross‑organization mutual TLS.

AI-written summary · about

" chapters (7)

1. 0:00Start
2. 11:20Low Overhead Authentication
3. 25:49Cloud-Based Kms Systems
4. 27:30The Top 10 Most Prevalent Cyber Security Attacks for Web Applications
5. 28:10How Does Spiffy Inspire Actually Work
6. 29:48The Split between Spiffy and Spire
7. 33:17The Secure Supply Chain Reference Architecture

" related talks

• 30mIntro: SPIFFEEmiliano Bernbaum, Scott Emmons · KubeCon + CloudNativeCon Europe 2019
• 33mSPIFFE and SPIRE: Architecture Deep DiveEvan Gilman, Andrew Harding · Production Identity Day: SPIFFE + SPIRE 2020
• 41mSPIFFE Project IntroAndrew Jessup, Emiliano Berenbaum · KubeCon + CloudNativeCon Europe 2018
• 36mSPIFFE: In Theory and in PracticeEvan Gilman, Andrew Harding · KubeCon + CloudNativeCon North America 2021
• 34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIREEvan Gilman · KubeCon + CloudNativeCon Europe 2019
• 36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]Evan Gilman · KubeCon + CloudNativeCon North America 2017
• 26mSPIFFE at GitHubEric Lee · Production Identity Day: SPIFFE + SPIRE 2020
• 36mFederated Identity for Distributed Systems: Understanding SPIFFELeon Krass · ContainerDays Hamburg 2026