From Adoption to Innovation: LinkedIn’s SPIRE Journey

on YouTube ↗26m

" summary

LinkedIn runs SPIRE to issue X.509 identities for hundreds of thousands of hosts and workloads, deploying regional SPIRE clusters that support 50k nodes per cluster and use TPM-based node attestation with a recorded-device EK registration workflow (TPM EK registration) to bind hardware to trust. The SPIRE servers keep CA material in HSM/TPM-backed memory but use in-memory signing for performance; an agentless GP service handles short-lived certs and GitHub OIDC, reducing first-fetch latency from ~30–60s to much lower.

AI-written summary · about

" chapters (11)

1. 0:00SPIRE journey at LinkedIn
2. 1:27Why SPIRE over SPIFFY
3. 3:13SPIRE advantages for LinkedIn
4. 4:17Trust model setup
5. 5:41SPIRE deployment architecture
6. 7:24TPM-based node attestation
7. 13:34Identity issuance workflow
8. 16:26Agent-based architecture challenges
9. 17:29Agentless for non-Linux workloads
10. 19:36Lessons from adoption
11. 21:23Q&A

" related talks

• 34mScaling SPIRE for Performance and AvailabilityTyler Julian · KubeCon + CloudNativeCon North America 2019
• 04mSecurely Bridging Cloud-Native and Traditional Workloads...Daniel Feldman · KubeCon + CloudNativeCon Europe 2021
• 33mSPIFFE and SPIRE: Architecture Deep DiveEvan Gilman, Andrew Harding · Production Identity Day: SPIFFE + SPIRE 2020
• 16mUsing SPIRE in Production at UberAndrew Moore · Production Identity Day: SPIFFE + SPIRE 2020
• 34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIREEvan Gilman · KubeCon + CloudNativeCon Europe 2019
• 30mIntro: SPIFFEEmiliano Bernbaum, Scott Emmons · KubeCon + CloudNativeCon Europe 2019
• 26mSPIFFE at GitHubEric Lee · Production Identity Day: SPIFFE + SPIRE 2020
• 33mUniform Workload Identity Everywhere: SPIRE Integrations and ExtensibilityRyan Turner · KubeCon + CloudNativeCon North America 2020 Virtual