SPIFFE and SPIRE: Architecture Deep Dive

on YouTube ↗33m

" summary

SPIRE implements the SPIFFE Workload API with an agent/server model: agents cache SVIDs and bundles, servers hold X.509 and JWT authorities and offload private keys to key manager plugins (memory, disk, TPM coming, KMS). Node attestation uses cloud metadata or TPM-challenges to bind nodes; workload attestation uses kernel/docker/Kubernetes selectors to mint SVIDs. Authority rotation prepares keys at half-life and activates at one-sixth to avoid validation gaps. Deployments scale horizontally, use nested SPIRE or federation for cross-domain resilience.

AI-written summary · about

" chapters (13)

1. 0:00Andrew Harding
2. 1:30Agenda
3. 3:34Spiffing Verifiable Identity Document
4. 4:41Spiffy Workload Api
5. 5:27The Federation Api
6. 7:30The Spire Agent
7. 14:51Workload Attestation
8. 18:05Key Manager Plug-In
9. 21:09Upstream Ca
10. 28:25Deployment Strategies
11. 30:00Nested Spire
12. 31:02Federation
13. 31:36Summary

" related talks

• 33mUniform Workload Identity Everywhere: SPIRE Integrations and ExtensibilityRyan Turner · KubeCon + CloudNativeCon North America 2020 Virtual
• 37mSPIFFE Deep DiveNeel Shah, Andrew Jessup, Emiliano Berenbaum · KubeCon + CloudNativeCon Europe 2018
• 41mSPIFFE Project IntroAndrew Jessup, Emiliano Berenbaum · KubeCon + CloudNativeCon Europe 2018
• 30mIntro: SPIFFEEmiliano Bernbaum, Scott Emmons · KubeCon + CloudNativeCon Europe 2019
• 34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIREEvan Gilman · KubeCon + CloudNativeCon Europe 2019
• 32mProduction Workload Identity with SPIRERyan Turner · KubeCon + CloudNativeCon North America 2021
• 34mScaling SPIRE for Performance and AvailabilityTyler Julian · KubeCon + CloudNativeCon North America 2019
• 49mReal World SPIFFE Scenarios and OutcomesAndres Vega, Frederick Kautz · KubeCon + CloudNativeCon Europe 2022