Uber x Security: Why and How We Built Our Workload Identity Platform
summary
Uber builds a workload identity platform based on SPIFFE IDs and the SPIRE agent/server model to issue x.509 and JWT identities via attestation, enabling mutual TLS between services. It targets scale — about 3,000 services, 400,000 containers, and 100 million batch jobs/day — and retrofits legacy systems with a sidecar. The system automates certificate issuance/rotation, reduces perimeter trust for GDPR/SOX compliance, and runs as a core component in production.
AI-written summary · about
chapters (17)
- 0:00Start
- 2:44Identity at Uber
- 3:04Scale
- 5:00Identity Scope
- 5:54Workload Identity
- 7:52Identity Benefits
- 10:40SPIFFE and SPIRE
- 11:06What makes a good identity document?
- 13:02SPIFFE Verifiable ID Document
- 14:16SPIFFE Workload API
- 14:56Authorization
- 15:40SPIFFE adoption
- 18:47SPIRE Goals
- 20:02Case Study
- 21:17Early: Service to DB (Direct Data Access)
- 23:41Growth: Service to Gateway (Proxied Data Access)
- 25:16Late: Service to Gateway (Migration)
related talks
33mUniform Workload Identity Everywhere: SPIRE Integrations and Extensibility
16mUsing SPIRE in Production at Uber
32mProduction Workload Identity with SPIRE
32mA Platform-Agnostic Approach to Securing Workloads
37mZero Trust Workload Identity in Kubernetes
04mSecurely Bridging Cloud-Native and Traditional Workloads...
36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
36mSecuring Agentic Platforms with Zero-Trust Workload Identities