Integrating SPIRE and Istio

on YouTube ↗15m

" summary

Modified Istio replaces its internal CA so Istio agents fetch identities from SPIRE instead of using the CSR API, implemented via Istio’s SecretManager interface and a glue layer to a SPIFFE Workload API implementation. Demo runs on an EKS two-node cluster hosting Bookinfo with sidecars (three reviews replicas) and visible in Kiali and Torniak. Planned features include hardware/cloud attestation, federation options, keeping root keys outside the cluster, and upstreaming the change into mainline Istio.

AI-written summary · about

" chapters (10)

1. 0:00Intro
2. 0:47Istio Background
3. 1:32Things we tried first
4. 3:49What is this project about?
5. 4:23What will this get us?
6. 6:07Solution overview
7. 7:02Istio (currently)
8. 8:46Looking at the fetch SVID flow
9. 10:00What comes next?
10. 11:22Bookinfo Demo

" related talks

• 16mUsing SPIRE in Production at UberAndrew Moore · Production Identity Day: SPIFFE + SPIRE 2020
• 36mFederated Identity for Distributed Systems: Understanding SPIFFELeon Krass · ContainerDays Hamburg 2026
• 38mStop Reinventing the Wheel with IstioMete Atamel · DevOps Pro Vilnius 2018
• 53mStop reinventing the wheel with IstioMete Atamel · NDC Oslo 2018
• 30mIstio New Workload Identity Provision Pipeline Based on Envoy SDSQuanjie Lin, Diem Vu · KubeCon + CloudNativeCon Europe 2019
• 26m10 Lessons From Migrating to SPIFFE After 10 Years Of Service Identity at SquareMat Byczkowski · Production Identity Day: SPIFFE + SPIRE 2020
• 46mStop reinventing the wheel with IstioMete Atamel · Voxxed Days Microservices 2018
• 40mIstio, your K8S cluster best friendKevin Davin · Voxxed Days Bucharest 2022