Scaling SPIRE for Performance and Availability

on YouTube ↗34m

" summary

SPIRE is the SPIFFE runtime that bootstraps workload identity using short-lived X.509 certs served by local agents and signed by a control-plane server; agents do optimistic fetching to cache credentials so workloads get sub-second responses while server-side signing scales horizontally. The talk covers the Kubernetes registrar, tradeoffs between per-host vs per-cluster registrations, and operational knobs like certificate lifetimes (default TTL one hour, community ranges from weeks down to 10–15s in tests) and caching for availability.

AI-written summary · about

" chapters (9)

1. 0:00Understanding zero trust
2. 3:48SPIFFE and SPIRE overview
3. 5:56Architecture of SPIRE
4. 7:55Short-lived credentials
5. 10:44Workload API and caching
6. 13:21Node attestation and server
7. 15:32Registration and policy
8. 18:39TTL trade-offs and summary
9. 21:21Audience Q&A session

" related talks

• 33mSPIFFE and SPIRE: Architecture Deep DiveEvan Gilman, Andrew Harding · Production Identity Day: SPIFFE + SPIRE 2020
• 26mSPIFFE at GitHubEric Lee · Production Identity Day: SPIFFE + SPIRE 2020
• 30mIntro: SPIFFEEmiliano Bernbaum, Scott Emmons · KubeCon + CloudNativeCon Europe 2019
• 34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIREEvan Gilman · KubeCon + CloudNativeCon Europe 2019
• 49mReal World SPIFFE Scenarios and OutcomesAndres Vega, Frederick Kautz · KubeCon + CloudNativeCon Europe 2022
• 19mFederate, Scale, and Secure: Practical SPIFFE/SPIRE for Containers...Anjali Telang · Open Source SecurityCon North America 2025
• 32mProduction Workload Identity with SPIRERyan Turner · KubeCon + CloudNativeCon North America 2021
• 04mSecurely Bridging Cloud-Native and Traditional Workloads...Daniel Feldman · KubeCon + CloudNativeCon Europe 2021