Multi-Cloud Workload Identity With SPIFFE
summary
Prototype uses SPIFFE SVIDs issued via cert-manager and the cert-manager-csi-driver-spiffe, with cert-manager-trust and a spiffe-connector server to exchange SVIDs for short-lived credentials. A sidecar reads the in-pod SVID (private key never leaves pod), contacts a single-replica connector (ACL maps SPIFFE IDs to GCP IAM keys and AWS assume-role), writes creds to SDK-expected files, and a live demo moves an object from S3 to GCS, proving the flow works.
AI-written summary · about
chapters (9)
- 0:00Introduction to speaker
- 1:34Workload identity concepts
- 3:59Current cloud challenges
- 8:08Introduction to SPIFFE
- 11:20Cert-manager and SPIFFE
- 15:30Developer experience goals
- 19:32Live demo and architecture
- 30:29Future work and conclusion
- 34:51Q&A session
related talks
36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
36mSPIFFE: In Theory and in Practice
34mDon't Mind the Gap: Securely Accessing Cloud Resources From Anywhere With SPIFFE/SPIRE
29mBridging the Great Divide: SPIFFE/SPIRE for Cross-Cluster Authentication
36mFederated Identity for Distributed Systems: Understanding SPIFFE
30mAdvancing Machine to Machine Workflows with the SPIFFE Identity Provider
32mFive Things You Didn’t Know You Could Do with SPIFFE and SPIRE