Providing Identities to Serverless Workloads
summary
SPIRE pushes X.509 identities out of the runtime and into platform stores so serverless functions can read them without an agent. It implements a SVIDStore plugin that listens to the SPIRE cache, writes identity JSON (private key, cert chain, bundle) to stores, and uses entry selectors to encode store-specific attributes like secret name. Example implementation uses AWS Secrets Manager and a Lambda extension that reads the secret from an env var, serves the certs to the function, and supports automatic rotation.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:59Agenda
- 1:47What is Serverless Computing
- 2:18Functions as a Service
- 3:44Workflow API
- 5:47SVD Store
- 12:28Terminal
- 16:58Function
related talks
32mProduction Workload Identity with SPIRE
36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
33mUniform Workload Identity Everywhere: SPIRE Integrations and Extensibility
30mIntro: SPIFFE
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
04mSecurely Bridging Cloud-Native and Traditional Workloads...
33mSPIFFE and SPIRE: Architecture Deep Dive
37mZero Trust Workload Identity in Kubernetes