Securing Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
summary
SPIFFE supplies a platform-agnostic identity format and SPIRE is its Go implementation that issues short‑lived x.509 or JWT identities via a local workload API over a UNIX socket, enabling direct mTLS between workloads. SPIRE uses pluggable node attestation and workload attestors (AWS metadata, GCP, Kubernetes, TPM or join tokens) and supports three topologies: horizontal servers, nested SPIRE with downstream intermediates, and a previewed federated trust domains model. Demo not shown; code and plugins are on GitHub.
AI-written summary · about
chapters (15)
- 0:00Start
- 0:51About Me
- 2:35SPIFFE ID
- 3:34SPIFFE Verifiable Identity Document
- 4:07SPIFFE Workload API
- 5:18SPIFFE in Hybrid Environments
- 7:00SPIRE Security Model
- 8:51SPIRE Overview
- 10:34Node Attestation
- 13:22Workload Identity
- 15:13Workload Attestation
- 18:33Scaling SPIRE
- 19:26Nested SPIRE
- 21:23Federated SPIRE [WIP]
- 23:40Learn More
related talks
29mBridging the Great Divide: SPIFFE/SPIRE for Cross-Cluster Authentication
33mSPIFFE and SPIRE: Architecture Deep Dive
04mSecurely Bridging Cloud-Native and Traditional Workloads...
19mFederate, Scale, and Secure: Practical SPIFFE/SPIRE for Containers...
49mReal World SPIFFE Scenarios and Outcomes
36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
41mSPIFFE Project Intro
33mUniform Workload Identity Everywhere: SPIRE Integrations and Extensibility