Tutorial: Demystifying and Enabling Workload Identity Across the Cloud Native Ecosystem
summary
Hands‑on demo deploys SPIFFE/SPIRE via Helm, installs torac UI for visibility, then configures Vault + CSI sidecar to replace a hardcoded MySQL credential with short‑lived, audience‑bound JWTs obtained by node and workload attestation. About 100 demo clusters are provisioned for the workshop; the presenters walk through installing CRDs, spawning agents, fetching a SWID JWT, exchanging it at Vault and decoding a base64 secret. The workflow is built and shown working end‑to‑end.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 3:13Workload identity in zero trust
- 8:36SPIFFE and SPIRE solutions
- 10:27SPIRE architecture
- 17:37Workshop setup
- 24:04Tutorial environment
- 26:38App and database deployment
- 31:36SPIRE Helm install
- 35:13Verify SPIRE and TORAC UI
- 37:58Vault for secrets
- 45:07SPIRE identity for debug pod
- 51:14App redeploy with sidecar
- 54:31Final demo and access
- 54:53Key takeaways
- 57:11Q&A
related talks
37mZero Trust Workload Identity in Kubernetes
34mThrow Away Your Passwords: Trusting Workload Identity
36mSecuring Agentic Platforms with Zero-Trust Workload Identities
36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
40mMulti-Cloud Workload Identity With SPIFFE
30mAdvancing Machine to Machine Workflows with the SPIFFE Identity Provider
33mUniform Workload Identity Everywhere: SPIRE Integrations and Extensibility
32mProduction Workload Identity with SPIRE