Production Workload Identity with SPIRE
Talkat KubeCon + CloudNativeCon North America 2021 · on Friday, 2021-10-15· at 16:30· Concourse Hall 153 ABC + Online·
summary
SPIRE implements SPIFFE identities as short-lived SVIDs (X.509 with a uri SAN and JWT) and runs a control plane of server + agents to sign and push credentials; X.509 SVIDs in the demo are 1 hour and JWTs are 5 minutes. Workloads fetch identities over a local gRPC Unix socket (fetch X509SVID is server-streaming), attestation uses unix/docker/kubernetes plugins and selectors, and agents auto-rotate and transparently push rotated credentials; federation, serverless and privileged-proxy flows are in progress.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:22Journey of a Services Organization
- 0:43v1: Three-Tier Architecture
- 2:15v2: Microservices Architecture
- 7:36Where Do We Go from Here?
- 8:24Workload Identity with SPIFFE
- 9:03SPIFFE 101 Q: How does SPIFFE describe a workload identity ?
- 9:24Anatomy of a SPIFFE ID
- 11:40Anatomy of an X.509-SVID
- 12:50Anatomy of a JWT-SVID
- 15:40Intro to SPIRE
- 17:08SPIRE Architecture
- 18:24A Day in the Life of an X.509-SVID
- 22:52Anatomy of a SPIRE Registration
- 25:00Workload Attestation
- 27:22What We've Seen So Far
- 28:58What's Coming Next in SPIRE
- 31:31Learn More about SPIFFE/SPIRE
related talks
33mUniform Workload Identity Everywhere: SPIRE Integrations and Extensibility
33mSPIFFE and SPIRE: Architecture Deep Dive
37mZero Trust Workload Identity in Kubernetes
30mIntro: SPIFFE
36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
49mReal World SPIFFE Scenarios and Outcomes
34mScaling SPIRE for Performance and Availability