Fortifying Microservice Security with SPIRE and OPA
Talkat Production Identity Day: SPIFFE + SPIRE 2020 · on Tuesday, 2020-11-17· at 15:50· Virtual, Virtual·
summary
SPIRE issues workload identities as SPIRE-issued JWT SVIDs via OIDC Federation and OPA decodes and validates those tokens (using the JWKS URI) to make authorization decisions. Demo uses an ACME Healthcare front end, invoice service and claim service; policy grants the role billing manager access to embedded insurance claims while other roles are denied. The invoice service forwards user and service tokens, OPA verifies audience chaining across issuers and returns allow or deny at request time, suitable for high-throughput microservice environments.
AI-written summary · about
chapters (5)
- 0:00Start
- 2:07OPA: General-purpose policy engine
- 3:04OPA: Features
- 4:09Demo Setup
- 7:21Propagating User Identity through JWT SVID
related talks
33mUniform Workload Identity Everywhere: SPIRE Integrations and Extensibility
32mProduction Workload Identity with SPIRE
32mA Platform-Agnostic Approach to Securing Workloads
34mDon't Mind the Gap: Securely Accessing Cloud Resources From Anywhere With SPIFFE/SPIRE
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
30mIntro: SPIFFE
04mSecurely Bridging Cloud-Native and Traditional Workloads...
32mFive Things You Didn’t Know You Could Do with SPIFFE and SPIRE