Federate, Scale, and Secure: Practical SPIFFE/SPIRE for Containers...

on YouTube ↗19m

" summary

SPIFFE/SPIRE issues short-lived identities (X.509 and JWT-SVIDs) and scales by using nested spire (intermediate CAs per cluster) and one-way federated spire trusts to extend boundaries. Production guidance calls for multiple SPIRE servers per trust domain, rate-limited OIDC endpoints, allow lists and audience restrictions, hardened agent access via CSI/UDS, strong crypto with key rotation (recommend half-TTL), post-quantum testing, and backing the datastore with a cloud-native Postgres operator for HA and DR.

AI-written summary · about

" chapters (11)

1. 0:00SPIFFE/SPIRE introduction
2. 1:27Workload identity in cloud-native
3. 3:36SPIFFE/SPIRE architecture
4. 6:54Secure SPIRE control plane
5. 10:48Hardening agent configurations
6. 12:54Post-quantum cryptography
7. 13:37Scaling with federated SPIRE
8. 15:48High availability strategies
9. 16:33Performance tuning SPIRE
10. 17:36Production readiness checklist
11. 17:56Q&A

" related talks

• 34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIREEvan Gilman · KubeCon + CloudNativeCon Europe 2019
• 33mSPIFFE and SPIRE: Architecture Deep DiveEvan Gilman, Andrew Harding · Production Identity Day: SPIFFE + SPIRE 2020
• 30mIntro: SPIFFEEmiliano Bernbaum, Scott Emmons · KubeCon + CloudNativeCon Europe 2019
• 41mSPIFFE Project IntroAndrew Jessup, Emiliano Berenbaum · KubeCon + CloudNativeCon Europe 2018
• 36mFederated Identity for Distributed Systems: Understanding SPIFFELeon Krass · ContainerDays Hamburg 2026
• 49mReal World SPIFFE Scenarios and OutcomesAndres Vega, Frederick Kautz · KubeCon + CloudNativeCon Europe 2022
• 34mScaling SPIRE for Performance and AvailabilityTyler Julian · KubeCon + CloudNativeCon North America 2019
• 29mBridging the Great Divide: SPIFFE/SPIRE for Cross-Cluster AuthenticationAndrew Harding · KubeCon + CloudNativeCon North America 2021