Securing Cloud-Native Workloads from the Metal Up
summary
Shows a concrete on‑prem identity bootstrapping: physical TPMs plus TPM EK/AK credential activation are used to prove each server’s unique identity, with a SPIRE agent/server flow issuing X.509s after a successful TPM challenge. Implementation uses the Spire TPM plugin, compares EKs against an EK allowlist hashes file, and runs on Ubuntu 24. Demonstration attests machines at first boot without manual post‑provisioning; PCR‑based boot integrity checks remain a planned enhancement.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 3:57Machine identity in data centers
- 7:06On-prem machine identity challenges
- 14:12Trusted Platform Module (TPM)
- 17:45TPM keys and attestation
- 19:57Spire and SPIFFE for identity
- 23:10TPM attestation flow with Spire
- 24:55Future improvements
- 25:58Q&A
related talks
18mSecuring Edge Systems with TPM 2.0 and SPIRE
04mSecurely Bridging Cloud-Native and Traditional Workloads...
36mSecuring Kubernetes with Trusted Platform Module (TPM)
34mThrow Away Your Passwords: Trusting Workload Identity
14mUsing DevIDs and TPMs for Node Attestation
40mUsing TPMs to Cryptographically Verify Devices at Scale
38mKeylime, Securing your Slice of the Cloud.
49mKeylime: Bootstrapping and Maintaining Trust