How SPIFFE Helps Istio in Service Mesh Federation
summary
Istio uses the SPIFFE trust domain and trust bundle to federate meshes by exchanging signed root bundles so workloads verify cross-mesh X.509s against mapped roots rather than blind cross-signing. Implementation shows Citadel and SPIRE publishing and consuming Citadel↔SPIRE trust bundle endpoints, bundles contain x5c base64 certificates and a 600-second refresh cadence, name constraints limit issuance, mutual TLS succeeds only when bundle verification matches and existing connections keep working until they reconnect because Istio does not renegotiate midstream.
AI-written summary · about
chapters (11)
- 0:00Start
- 2:18What is SPIFFE?
- 3:15Istio Identity Framework
- 4:10Why Service Mesh Federation Matters?
- 5:03Identity Federation Challenges
- 6:12Service Mesh and Trust Domain
- 7:31Federation of Meshes
- 8:22Federation within an Organization
- 10:20Federation across Organizations (1)
- 14:20SPIFFE Trust Bundle Example
- 16:26Federation with SPIFFE Trust Bundle (2)
related talks
30mHow SPIFFE Helps Istio in Service Mesh Federation
32mSecuring Communication Between Meshes and Beyond with SPIFFE Federation
49mReal World SPIFFE Scenarios and Outcomes
31mBridging Mesh Enclaves: Securing and Maintaining Mesh Heterogeneity
07m⚡ Lightning Talk: Using Istio and SPIRE to Trust Cross-domain Traffic in Hybrid Cloud Scenarios
27mBridging Trust Between Multi-Cluster Meshes
29mBridging the Great Divide: SPIFFE/SPIRE for Cross-Cluster Authentication
41mSPIFFE Project Intro