Untangling the Multi-Cloud Identity and Access Problem With SPIFFE Tornjak
Talkat KubeCon + CloudNativeCon North America 2021 · on Thursday, 2021-10-14· at 16:30· Room 408 AB + Online·
summary
Claim: replace fragile cloud-to-cloud federation and long‑lived keys with an organization‑wide workload identity. Implementation uses SPIFFE/SPIRE/Tornjak deployed as a central trust server plus per‑node agents and a Kubernetes workload registrar that issues X.509/JWT identities, then federates to AWS via OIDC so a pod in IBM Cloud reads an S3 file from the mars_spire S3 bucket after attestation. Demo shows multi‑cluster (AWS, Azure, IBM) setup, policy conditions (trust domain, region, cluster, namespace, service account, pod name) and a single point of federation managing scale and audit.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 5:03Problems with federation
- 6:57User identities
- 7:54Workload identities
- 10:13Technology
- 11:44Scenario
- 14:30Universal Workload Identity
- 15:42Demo
- 23:18Summary
related talks
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
04mSecurely Bridging Cloud-Native and Traditional Workloads...
36mFederated Identity for Distributed Systems: Understanding SPIFFE
40mMulti-Cloud Workload Identity With SPIFFE
36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
19mFederate, Scale, and Secure: Practical SPIFFE/SPIRE for Containers...
34mDon't Mind the Gap: Securely Accessing Cloud Resources From Anywhere With SPIFFE/SPIRE
30mAdvancing Machine to Machine Workflows with the SPIFFE Identity Provider