SPIFFE in Practice: Universal Identity for WebAssembly Workloads
Talkat KubeCon + CloudNativeCon Europe 2025 · on Thursday, 2025-04-03· at 15:00· Level 1 | Hall Entrance S10 | Room C·
summary
Project integrates SPIFFE/SPIRE into wasmCloud to give each WebAssembly component a short‑lived identity, using the delegated identity API so workloads invisible to the node agent can still get SVIDs. Demo exchanges an SVID for AWS STS credentials and calls Bedrock successfully. Challenges: tokens rotate as often as every five minutes, Rust SDK usage is the only wide adopter today, Windows named‑pipe support is missing. Proof‑of‑concept works end‑to‑end.
AI-written summary · about
chapters (14)
- 0:00SPIFFE introduction
- 1:47FedRAMP with Docker
- 4:16Why WebAssembly
- 6:46Microservice platform needs
- 8:50WASMCloud with NATS and SPIFFE
- 9:34SPIFFE in WASMCloud
- 12:23Delegated identity API
- 15:26Demo setup
- 16:52Live demo
- 19:46Demo recap
- 20:49Implementation lessons
- 22:53Future improvements
- 24:17Why SPIFFE matters
- 25:20Summary and resources
related talks
36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
36mSPIFFE: In Theory and in Practice
36mFederated Identity for Distributed Systems: Understanding SPIFFE
31mCommunity Integrations and other Works in Progress
32mProduction Workload Identity with SPIRE
41mSPIFFE Project Intro
40mMulti-Cloud Workload Identity With SPIFFE
30mIntro: SPIFFE