Workload Identity for Humans: A Twelve-Factor Approach
Talkat KubeCon + CloudNativeCon Europe 2025 · on Thursday, 2025-04-03· at 16:45· Level 1 | Hall Entrance N10 | Room E·
summary
Proposes platform-managed, connection-scoped credentials that rotate every 30–60 minutes to avoid long-lived secrets and confused-deputy risks, using existing OIDC or X.509 primitives; demonstrates a factor CLI polyfill that injects tokens locally and on Heroku, proxies validate tokens and set an X-Client-ID header for backends, and refresh uses file watches. Prototype writes to S3 via AWS web identity tokens, works in demos but faces SDK quirks and non‑HTTP service integration challenges.
AI-written summary · about
chapters (11)
- 0:00Workload identity intro
- 1:0412-factor manifesto
- 3:54Secrets in config problems
- 6:00Better credentials design
- 13:18Chicken-and-egg problem
- 14:43Demo: factor CLI polyfill
- 20:41Deploy to Heroku polyfill
- 23:09S3 requests with workload ID
- 24:58Cloud service challenges
- 25:59Summary and collaboration
- 27:45Q&A on workload identity
related talks
34mThrow Away Your Passwords: Trusting Workload Identity
34mThrow Away Your Passwords: Trusting Workload Identity
39mManaging Trust Between Multiple Clouds and Non-human Identities Without Passwords
34mWho Are You? I Really Want to Know… the Magic Behind OIDC
45mModern Identity Management in the Era of Serverless and Microservices
08mModern Identity Management and Learning from Developers Around the World
36mSecuring Agentic Platforms with Zero-Trust Workload Identities
45mManaging hybrid workloads with IAM Roles Anywhere, featuring