Securing Communication Between Meshes and Beyond with SPIFFE Federation
Talkat KubeCon + CloudNativeCon North America 2019 · on Thursday, 2019-11-21· at 14:25· Room 6C - San Diego Convention Center, Upper Level·
summary
Demonstrates SPIFFE federation enabling cross-domain authentication between an Istio mesh and a SPIRE-managed VM fleet: it exchanges authority public keys via an HTTP SPIFFE bundle endpoint, validates x.509 SVIDs and establishes mutual TLS between sidecars and off‑mesh workloads. Implementation uses an Istio Federation server, SPIRE server/agents, ghostunnel as the VM proxy, and a ConfigMap bootstrap of CA roots (operator does one-time copy). Demo initially fails, then succeeds after federation; solution is a working prototype with some configmap workarounds.
AI-written summary · about
chapters (11)
- 0:00Start
- 1:25What is a Service Mesh?
- 4:17SPIFFE Identity
- 6:18Identity in a Service Mesh
- 7:25Hybrid and multi-mesh examples
- 8:29Basic rules from the security lens
- 9:42Limitations of shared authority
- 12:01SPIFFE Federation API
- 13:32SPIFFE Federation: An Example
- 14:56Federation Demo Architecture
- 22:52Full Disclosure
related talks
30mHow SPIFFE Helps Istio in Service Mesh Federation
30mHow SPIFFE Helps Istio in Service Mesh Federation
31mBridging Mesh Enclaves: Securing and Maintaining Mesh Heterogeneity
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
27mBridging Trust Between Multi-Cluster Meshes
49mReal World SPIFFE Scenarios and Outcomes
07m⚡ Lightning Talk: Using Istio and SPIRE to Trust Cross-domain Traffic in Hybrid Cloud Scenarios
36mFederated Identity for Distributed Systems: Understanding SPIFFE