10 Lessons From Migrating to SPIFFE After 10 Years Of Service Identity at Square
Talkat Production Identity Day: SPIFFE + SPIRE 2020 · on Tuesday, 2020-11-17· at 15:10· Virtual, Virtual·
summary
Square deploys SPIRE servers on-prem with an agent on each host, builds a custom workload registrar, and registers identities for over a thousand services so certificates rotate automatically and Envoy consumes identities via SDS. Migration uses feature flags to flip between legacy certs and SPIFFE IDs, adds DNS names and shared trust bundles for backward compatibility, and uncovers a database perf bottleneck in shadow mode that SPIRE core helps reduce. Staffing runs three core engineers ramping to six or seven and certificates use a 24-hour TTL.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:01Origins of Service Identity at Square
- 5:13The Migration Process
- 8:57What We Learned
- 9:52The Community is your superpower
- 10:39Take Principled Risks
- 12:01Backward Compatibility is a Must
- 13:44Manage Your ROI
- 15:09Security isn't a good selling point
- 16:07Make Migration self-serve or DIY
- 17:35Infrastructure Ossifies ; Abstractions Leak
- 19:34Mental Models are hard to overcome
- 20:53Lower TTL means higher on-call pressure
- 22:16Teamwork Makes the Dreamwork!
- 22:37Questions?
related talks
49mReal World SPIFFE Scenarios and Outcomes
30mIntro: SPIFFE
34mScaling SPIRE for Performance and Availability
19mFederate, Scale, and Secure: Practical SPIFFE/SPIRE for Containers...
36mFederated Identity for Distributed Systems: Understanding SPIFFE
15mChanging the SPIFFE ID of Every SPIRE-Enabled Workload at Uber - Challenges and Lea...
32mProduction Workload Identity with SPIRE
28mCan I Trust You? Service-to-Service Identity with SPIFFE