Introducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
summary
Defines a standardized workload identity format (SPIFFE), a node/workload attestation flow, and a local workload API that issues short‑lived X.509 SVIDs; implements it with SPIRE (agent + server, plugin attestations for AWS, Kubernetes, UNIX). Demo runs across three VMs, mints certs on registration, and establishes mutual TLS via ghostunnel — automatic issuance and rotation work end to end. Project has ~150 contributors from 40 companies and a CNCF adoption proposal.
AI-written summary · about
chapters (8)
- 0:00Start
- 1:03Not Your Parent's Network Security
- 2:09Software is Eating the World
- 8:13Universal Workload Identity
- 13:07How Do I SPIFFE?
- 21:17Secure Introduction
- 22:23Demo Time!
- 33:24Looking Forward
related talks
36mFederated Identity for Distributed Systems: Understanding SPIFFE
30mIntro: SPIFFE
36mSPIFFE: In Theory and in Practice
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
41mSPIFFE Project Intro
49mReal World SPIFFE Scenarios and Outcomes
33mUniform Workload Identity Everywhere: SPIRE Integrations and Extensibility
32mProduction Workload Identity with SPIRE