Using a CRD to better integrate SPIRE and Kubernetes
Talkat Production Identity Day: SPIFFE + SPIRE 2020 · on Tuesday, 2020-11-17· at 15:35· Virtual, Virtual·
summary
A Kubernetes CustomResourceDefinition translates YAML into SPIRE registration entries so kubectl can create, edit and delete SVIDs; the registrar runs as a sidecar container inside the SPIRE server statefulset and is event driven. It supports kubectl integration, auto-generate SVIDs on pod create with cleanup on delete, parents SVIDs to the node, and adds DNS names required for mTLS. Demo on a two‑node cluster shows entries created and the entry ID populated in the CRD status.
AI-written summary · about
chapters (4)
related talks
29mBridging the Great Divide: SPIFFE/SPIRE for Cross-Cluster Authentication
34mScaling SPIRE for Performance and Availability
20mManaging Kubernetes Webhooks with SPIRE
30mIntro: SPIFFE
27mDeep Dive: SPIFFE
36mExtending Kubernetes with CustomResouceDefinition
33mUniform Workload Identity Everywhere: SPIRE Integrations and Extensibility
17mWorking Out SPIFFE Identity for Cilium CNI