Using SPIRE in Production at Uber
Talkat Production Identity Day: SPIFFE + SPIRE 2020 · on Tuesday, 2020-11-17· at 14:05· Virtual, Virtual·
summary
Deployment spans dozen data centers with under 10 SPIRE servers per DC, a dedicated agent on every host, and tens of millions of x509 signings per day. A custom security library (and fallback binary) wraps SPIFFE/SPIRE identities, injects short‑lived tokens signed by x509 SVIDs, and enforces authorization by SPIFFE ID. Results: over 500 services onboarded (≈<10% of internal services), trivial per-service changes, planned sidecar option, and improved resiliency and interoperability.
AI-written summary · about
chapters (8)
- 0:00Intro
- 0:30Scale
- 1:00Environments
- 1:20Server Deployment Integration
- 3:00Onboarding Consumers
- 3:45Authentication Authorization
- 4:45How it Works
- 8:55QA
related talks
30mIntro: SPIFFE
19mFederate, Scale, and Secure: Practical SPIFFE/SPIRE for Containers...
49mReal World SPIFFE Scenarios and Outcomes
34mScaling SPIRE for Performance and Availability
33mUniform Workload Identity Everywhere: SPIRE Integrations and Extensibility
41mSPIFFE Project Intro
29mBeyond Proof of Concept: Keys to a Successful SPIRE Rollout in Production
32mProduction Workload Identity with SPIRE