Production Identity Day: SPIFFE + SPIRE North America 2021
2021-10-11
-- online --
as the organisers put it
A vendor-neutral conference focused on solving for zero trust security using SPIFFE/SPIRE, Workload Identity, and Hardware and Software attestation.
who it's for
platform engineers, security engineers, cloud engineers, site reliability engineers, kubernetes operators, service mesh engineers, identity architects
topics
SPIRE agent and server; SPIFFE ID format migration; SVID short-lived certificates; SPIRE release and audit updates; SPIRE integration with Istio; Cilium delegated identity API; SPIRE SVIDStore for serverless; AWS OIDC integration with SPIFFE; SGX confidential computing integration; TPM 2.0 edge attestation with SPIRE; cross-cluster trust federation
| title | author | length |
|---|---|---|
| Keynote: Welcome & State of the Union | Evan Gilman | 06m |
Project updates report concrete growth: SPIRE 1.0 and 11 releases in the last year with a roughly five‑week release cadence, contributors up ~50%, and 30% of… | ||
| Keynote: Creating with Authenticity & Humility: A SPIFFE Origin Story | Sunil James | 11m |
A concise origin story of SPIFFE: a 2016 Google design doc seeds a community that turns production-grade identity ideas into working code, built on Google’s… | ||
| Economics of Zero Trust | Frederick Kautz, Ed Warnicke | 10m |
Argument frames Zero Trust as an economic tradeoff: attackers compare risk versus reward while defenders must count development, operations and annualized loss… | ||
| SPIRE Project Updates | Ryan Turner | 20m |
Project reports 11 releases, 49 new features, 59 bug fixes and 339 merged PRs from 48 contributors, and declares 1.0.0 released in July. A Tier 53 white‑box… | ||
| Keynote: Cloud & Cloud Native Identity and Access Management: Challenges & Opportunities | Aradhna Chetal, Greg Blana, Nathan Coffing, Craig Thomas | 23m |
Argues that solving zero trust requires concrete pieces not slogans: adopt SPIFFE/SPIRE for workload identity, issue SVID short-lived certs to every container… | ||
| Working Out SPIFFE Identity for Cilium CNI | Rahul Arvind Jadhav | 17m |
Cilium integrates SPIFFE/SPIRE by adding a delegated identity API that lets the node-local Cilium agent fetch SVIDs for pods (via a Unix domain socket and… | ||
| Providing Identities to Serverless Workloads | Agustín Martínez Fayó, Marcos Yacob | 21m |
SPIRE pushes X.509 identities out of the runtime and into platform stores so serverless functions can read them without an agent. It implements a SVIDStore… | ||
| Supporting Confidential Workloads with SPIRE | Andrey Brito, Matteus Silva | 20m |
Adds SGX support to SPIRE by integrating with SCONE so confidential workloads and SPIRE components run inside SGX enclaves and use SCONE CAS for attestation… | ||
| AWS OIDC Authentication with SPIFFE at Square | Roy Xu | 12m |
Square extends SPIFFE to AWS by building an OIDC pipeline that exchanges SPIFFE JWTs for AWS creds using the open source spiffe-aws-assume-role tool, a SPIRE… | ||
| Federating Trust in Healthcare with SPIFFE | Sunil Ravipati | 08m |
Claims a workable federated zero trust for healthcare that uses mTLS via SPIFFE/SPIRE and Envoy proxy for cross-cluster auth to let partner workloads access… | ||
| Integrating SPIRE and Istio | Daniel Feldman, Glaucimar Aguiar | 15m |
Modified Istio replaces its internal CA so Istio agents fetch identities from SPIRE instead of using the CSR API, implemented via Istio’s SecretManager… | ||
| Changing the SPIFFE ID of Every SPIRE-Enabled Workload at Uber - Challenges and Lea... | Prasad Borole | 15m |
Uber migrates the SPIFFE ID format across a fleet of SPIRE agents on thousands of hosts and million+ identities, creating parallel registrations so workloads… | ||
| Securing Edge Systems with TPM 2.0 and SPIRE | Cole Kennedy | 18m |
Uses TPM 2.0 to remote-attest edge machines via SPIRE, reading PCR4 and PCR5 boot MBR hashes and verifying TPM quotes, then issues a SPIFFE identity derived… | ||
| Managing Kubernetes Webhooks with SPIRE | Faisal Memon | 20m |
SPIRE automates webhook certificate lifecycle: it pushes the SPIRE root CA into webhook configs via the k8s-bundle-notifier plugin, creates the required SVID… | ||
| Secure, Efficient API Plane Traversal for Compute Resources on Exascale Super Comput... | Tim Pletcher | 22m |
Cray Shasta uses SPIRE to replace long‑lived service account OIDC tokens with short‑lived workload identities, integrating with Kubernetes, Keycloak, Vault… | ||
| Closing Remarks | Evan Gilman | 03m |
Closing notes list concrete follow ups: pick up a spiffy book at the HPE booth (PDF is free online), nominations are open for the SPIFFE steering committee… | ||
| SPIFFE Project Updates | Evan Gilman | 03m |
Year-long work focuses on stabilization across SPIFFE and SPIRE with concrete governance and engineering changes: renewed TSC charter that codifies mission and… | ||
| nothing matches | ||