Throw Away Your Passwords: Trusting Workload Identity
summary
Explains how Kubernetes service account tokens become token review API workload identity, why projected (bound) tokens limit impersonation, and how the service account issuer OIDC discovery plus JWKS lets you validate tokens and swap them for temporary cloud creds (avoid long‑lived keys) with AWS IRSA and GitHub OIDC. Covers SPIFFE/SPIRE SVIDs and x509s for cross‑cluster identities and mTLS via Envoy SDS, and emerging hardware roots like TPM/Keylime and trusted execution for stronger node attestation.
AI-written summary · about
chapters (6)
- 0:00Throw Away Your Passwords: Trusting Workload Identity Andrew Martin, Control Plane
- 4:29This Secret Zero sounds good, where can I get one?
- 6:47Don't use long lived Service Account tokens
- 8:17So now we have a Secrets Management problem again
- 12:33What does that look like?
- 27:39You said something about Hardware Root of Trust?
related talks
34mThrow Away Your Passwords: Trusting Workload Identity
36mSecuring Agentic Platforms with Zero-Trust Workload Identities
05mLightning Talk: Don’t Make Me Impersonate My Identity
37mZero Trust Workload Identity in Kubernetes
34mWho Are You? I Really Want to Know… the Magic Behind OIDC
29mWorkload Identity for Humans: A Twelve-Factor Approach
50mDestroying Long-Lived Cloud Credentials with Workload Identity Federation
39mManaging Trust Between Multiple Clouds and Non-human Identities Without Passwords