Five Things You Didn’t Know You Could Do with SPIFFE and SPIRE
Talkat KubeCon + CloudNativeCon North America 2019 · on Tuesday, 2019-11-19· at 11:50· Room 31ABC - San Diego Convention Center, Upper Level·
summary
A live five-service banking demo shows workloads in GKE with Envoy sidecars and one MySQL on AWS RDS authenticating via SPIFFE/SPIRE using x.509 SVIDs and OIDC federation to mint STS tokens, all with no passwords or API keys. The demo successfully reads/writes data, rotates short-lived SVIDs (default ~1 hour, configurable shorter), and proves cross-cloud mutual TLS. Cloud OIDC support is working for AWS today; Google and Microsoft are discussed as forthcoming.
AI-written summary · about
chapters (7)
- 0:00Start
- 7:11Zero Trust Networking
- 7:36Tls Transport Layer Security
- 11:21Spire the Spiffy Runtime Environment
- 18:02Sample Banking Application
- 23:41Trust Relationship
- 29:31Are There Ways To Lock Down the the Keys that Your Onac Provider Is Using
related talks
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
34mDon't Mind the Gap: Securely Accessing Cloud Resources From Anywhere With SPIFFE/SPIRE
49mReal World SPIFFE Scenarios and Outcomes
37mSPIFFE Deep Dive
26mKeynote: Introduction to SPIFFE
40mMulti-Cloud Workload Identity With SPIFFE
29mBridging the Great Divide: SPIFFE/SPIRE for Cross-Cluster Authentication
36mFederated Identity for Distributed Systems: Understanding SPIFFE