A Platform-Agnostic Approach to Securing Workloads
summary
Demonstrates a platform-agnostic identity and attestation flow where SPIRE issues SPIFFE x.509 identities and the SPIRE agent as SDS server pushes certificates to Envoy, which enforces mutual TLS via Envoy between proxies. Shows GraphQL → orders → products calls succeeding with mTLS and one intentional certificate mismatch that fails validation. Uses SDS for certificate and trust-bundle delivery, supports federated roots (ACMPCA or cert-manager), and positions this as an interoperable, app-transparent foundation for workload authentication.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:03Modern systems complexity
- 9:22Universal identity standard
- 15:17SPIFFE and SPIRE
- 19:28Architecture overview
- 22:16Live demo: SPIFFE validation
- 24:20Q&A: AWS services
- 25:23Q&A: Trust domains
- 27:22Q&A: Attribute-based auth
- 29:07Q&A: Certificate attributes
- 31:13Closing remarks
related talks
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
33mUniform Workload Identity Everywhere: SPIRE Integrations and Extensibility
04mSecurely Bridging Cloud-Native and Traditional Workloads...
33mSPIFFE and SPIRE: Architecture Deep Dive
32mProduction Workload Identity with SPIRE
36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
30mIntro: SPIFFE
36mFederated Identity for Distributed Systems: Understanding SPIFFE