Throw Away Your Passwords: Trusting Workload Identity
summary
Argues that workloads should use short‑lived cryptographic identities instead of passwords and shows concrete tooling: Kubernetes projected bound service account tokens validated via the TokenReview API, SPIRE issuing SPIRE SVID/x509 for mTLS and Vault login, and Envoy SDS integration. Describes node‑agent and cloud‑metadata attestation models, blast radius when a node is compromised, and hardware anchoring with TPM attestation plus supply‑chain signing using cosign + in‑toto; predicts production readiness in 6–18 months.
AI-written summary · about
chapters (8)
- 0:00Start
- 3:45Ye Olde Ways
- 4:17Dynamic Infrastructure
- 5:16What do we need?
- 7:20Token Review API
- 8:04Bound Service Account Tokens
- 9:01Service Account Issuer Discovery
- 13:18Web Identity Federation
related talks
34mThrow Away Your Passwords: Trusting Workload Identity
39mManaging Trust Between Multiple Clouds and Non-human Identities Without Passwords
36mSecuring Agentic Platforms with Zero-Trust Workload Identities
45mAttackers' Nightmare: An Infrastructure Without Secrets
37mZero Trust Workload Identity in Kubernetes
40mNOPASSWD: Building a Passwordless Cloud Infrastructure
01h 05mTutorial: Demystifying and Enabling Workload Identity Across the Cloud Native Ecosystem
29mWorkload Identity for Humans: A Twelve-Factor Approach