Can I Trust You? Service-to-Service Identity with SPIFFE
summary
Shows a concrete replacement for shared long‑lived secrets: SPIFFE identities issued by SPIRE, X.509 certs default to one hour with 20‑minute rotation and JWTs to ~5 minutes, delivered via the workload API over a Unix socket. Demos show a Python SPIFFE toolkit and an automatically rotating SSL context that plugs into requests/HTTPX, Kubernetes selectors (serviceAccount/pod) as attestation, and an Envoy sidecar pattern; short‑lived certs, workload socket attestation, automatic rotation, Kubernetes service‑account selector.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:19Service identity problems
- 3:06Castle model flaws
- 4:30Attack with Omen intruder
- 5:31Shared secrets fail
- 6:55mTLS limitations
- 9:41SPIFFE discovery
- 10:24SPIFFE and SPIRE
- 12:55SPIRE node attestation
- 14:21Workload identities
- 15:26SPIFFE attack prevention
- 16:49Demo identity generation
- 17:31Enforcing identity
- 18:54Integrating SPIFFE
- 19:56Authorization options
- 20:39SPIFFE real-world use
- 22:28Summary
- 22:52Q&A
related talks
36mFederated Identity for Distributed Systems: Understanding SPIFFE
49mReal World SPIFFE Scenarios and Outcomes
36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
36mSPIFFE: In Theory and in Practice
32mProduction Workload Identity with SPIRE
30mIntro: SPIFFE
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
41mSPIFFE Project Intro