Don't Mind the Gap: Securely Accessing Cloud Resources From Anywhere With SPIFFE/SPIRE

on YouTube ↗34m

" summary

Claim: replace long‑lived cloud API keys by exchanging short‑lived SPIFFE SVIDs for cloud creds using OIDC. Implementation uses a SPIRE server + agent deployment with the SPIRE OIDC Discovery Provider, then cloud-specific bridges: AWS STS role-assume via the Square Spiffe AWS assume role helper, Azure OIDC role mapping, and a GCP metadata proxy that emulates the metadata endpoint. Large installs exist (over a million agents), community tools published, and teams report apps migrating unchanged while removing secret storage and rotation.

AI-written summary · about

" chapters (7)

1. 0:00Start
2. 2:34The SPIFFE ID
3. 5:00The SPIFFE Bundle
4. 6:01SPIFFE Federation
5. 8:20SPIRE Components
6. 10:40SPIRE OIDC Discovery Provider
7. 21:41Key Takeaways

" related talks

• 34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIREEvan Gilman · KubeCon + CloudNativeCon Europe 2019
• 33mSPIFFE and SPIRE: Architecture Deep DiveEvan Gilman, Andrew Harding · Production Identity Day: SPIFFE + SPIRE 2020
• 41mSPIFFE Project IntroAndrew Jessup, Emiliano Berenbaum · KubeCon + CloudNativeCon Europe 2018
• 19mFederate, Scale, and Secure: Practical SPIFFE/SPIRE for Containers...Anjali Telang · Open Source SecurityCon North America 2025
• 32mFive Things You Didn’t Know You Could Do with SPIFFE and SPIREAndres Vega, Andrew Jessup · KubeCon + CloudNativeCon North America 2019
• 49mReal World SPIFFE Scenarios and OutcomesAndres Vega, Frederick Kautz · KubeCon + CloudNativeCon Europe 2022
• 40mMulti-Cloud Workload Identity With SPIFFEJake Sanders, Charlie Egan · KubeCon + CloudNativeCon Europe 2022
• 33mUniform Workload Identity Everywhere: SPIRE Integrations and ExtensibilityRyan Turner · KubeCon + CloudNativeCon North America 2020 Virtual