Deep Dive: SPIFFE

on YouTube ↗27m

" summary

SPIRE is deployed on Kubernetes with the server usually as a statefulset + PVC and agents as a daemonset that expose the workload API via a UNIX domain socket directory mount; production requires a shared database (Postgres/MySQL) because the certificate bundle is eventually consistent. Kubernetes-specific attesters include a service account token tester and a projected service account token tester (K8s 1.12+). A new bundle notifier plugin stores the trust bundle in a ConfigMap. Demo on minikube succeeds and the project is released as 0.8.

AI-written summary · about

" chapters (6)

1. 0:00Start
2. 1:29K8 work
3. 7:51SPIRE Server • Typically deployed as a StatefulSet
4. 9:26SPIRE Agent
5. 11:01Node Attestation
6. 14:14Registration Entries

" related talks

• 33mSPIFFE and SPIRE: Architecture Deep DiveEvan Gilman, Andrew Harding · Production Identity Day: SPIFFE + SPIRE 2020
• 37mSPIFFE Deep DiveNeel Shah, Andrew Jessup, Emiliano Berenbaum · KubeCon + CloudNativeCon Europe 2018
• 29mBridging the Great Divide: SPIFFE/SPIRE for Cross-Cluster AuthenticationAndrew Harding · KubeCon + CloudNativeCon North America 2021
• 34mScaling SPIRE for Performance and AvailabilityTyler Julian · KubeCon + CloudNativeCon North America 2019
• 26mSPIFFE at GitHubEric Lee · Production Identity Day: SPIFFE + SPIRE 2020
• 36mFederated Identity for Distributed Systems: Understanding SPIFFELeon Krass · ContainerDays Hamburg 2026
• 33mUniform Workload Identity Everywhere: SPIRE Integrations and ExtensibilityRyan Turner · KubeCon + CloudNativeCon North America 2020 Virtual
• 49mReal World SPIFFE Scenarios and OutcomesAndres Vega, Frederick Kautz · KubeCon + CloudNativeCon Europe 2022