Supporting Confidential Workloads with SPIRE
summary
Adds SGX support to SPIRE by integrating with SCONE so confidential workloads and SPIRE components run inside SGX enclaves and use SCONE CAS for attestation. Uses the session name and session hash as selectors so workloads register identities as session name + session hash, and the agent pushes those identities into the CAS then delivers sealed credentials to the enclave. Shows a Kafka producer/consumer demo, details threats (untrusted orchestrator, stolen cached entries, VM migration limits) and ongoing work on namespaces and workload API integration.
AI-written summary · about
chapters (9)
- 0:00Intro
- 0:32What is Confidential Computing
- 5:16Drivers for Integrating Confidential Computing
- 8:34Challenges
- 13:37Why SPIRE
- 14:18Workloads
- 15:08Integration
- 16:14Demo
- 19:12Conclusion
related talks
33mSPIFFE and SPIRE: Architecture Deep Dive
19mAttestation and identity provisioning to Intel SGX workloads
32mA Platform-Agnostic Approach to Securing Workloads
32mProduction Workload Identity with SPIRE
34mScaling SPIRE for Performance and Availability
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
33mUniform Workload Identity Everywhere: SPIRE Integrations and Extensibility
37mZero Trust Workload Identity in Kubernetes