Uniform Workload Identity Everywhere: SPIRE Integrations and Extensibility

on YouTube ↗33m

" summary

SPIRE implements the SPIFFE spec with a plugin-based control plane that issues SVIDs over a Unix domain socket and chains to existing PKI; built-in upstream authorities include AWS PCA, HashiCorp Vault and AWS Secrets Manager, node attestors use cloud metadata (AWS/Azure/GCP) or Kubernetes projected service account tokens, workload attestors query the kernel and kubelet, and Envoy integration via SDS enables transparent mTLS. The server/agent model and key‑manager/notifier plugins are proven in mixed cloud and on‑prem deployments and support custom external plugins for bespoke host attestation.

AI-written summary · about

" chapters (12)

1. 0:00Uniform Workload Identity Everywhere: SPIRE Integrations and Extensibility Ryan Turner, Uber
2. 0:25Common Integration Challenges Virtual • Using multiple environments - public and/or private clouds • Proprietary tooling and infrastructure Mix of legacy and cloud-native applications • Enforcing uniform authentication across all RPCs
3. 3:58Open-source implementation of SPIFFE specification • Control plane for identity distribution/rotation • Scalable distributed system
4. 8:09Controlling select functionality and security properties Consumption of SPIRE-issued identity Downstream integrations Simplifying propagation of SVIDs Using SVID as authentication material for external domains
5. 16:15Applies to: Server • Synchronizes upstream PKI chain/keys with SPIRE • Handles CSRs for SPIRE CA Optionally accepts SPIRE JWT signing keys Available built-in plugins
6. 18:03Applies to: Server, Agent • Authenticates a node (physical or virtual) in the infrastructure • Challenge-response protocol Defines bridge of trust between host identity system and SPIRE • Built-in plugins
7. 21:16Selectors can be based on host metadata or be static • Enables distribution of identities to more finely-grained subsets of hosts Alias registration entries matching node selectors can be used to
8. 23:35WorkloadAttestor Applies to: Agent Interrogates trusted system for attributes of process • Matches workload metadata to selectors of identity registrations • Example authorities: OS kernel, orchestration platform • Built-in plugins
9. 25:58Private key generation Computes digital signatures of data Built-in plugins
10. 27:42Plugin interfaces defined in proto/spire/agent, server /* Implement respective plugin interface Add HCL config stanza for respective component(s) (Server and/or Agent) Example for custom NodeAttestor plugin called mynodeattestor
11. 29:34Envoy DMTLS using X.509 SVIDs SPIRE Workload API implements Envoy SDS • OIDC Federation Authenticate to external services with SVIDS Example using a JWT-SVID to invoke AWS APIs
12. 31:20Agentless mode Enables serverless use cases • Integration with Apache data projects

" related talks

• 33mSPIFFE and SPIRE: Architecture Deep DiveEvan Gilman, Andrew Harding · Production Identity Day: SPIFFE + SPIRE 2020
• 32mProduction Workload Identity with SPIRERyan Turner · KubeCon + CloudNativeCon North America 2021
• 34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIREEvan Gilman · KubeCon + CloudNativeCon Europe 2019
• 30mIntro: SPIFFEEmiliano Bernbaum, Scott Emmons · KubeCon + CloudNativeCon Europe 2019
• 36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]Evan Gilman · KubeCon + CloudNativeCon North America 2017
• 32mA Platform-Agnostic Approach to Securing WorkloadsLukonde Mwila · EnvoyCon 2023
• 49mReal World SPIFFE Scenarios and OutcomesAndres Vega, Frederick Kautz · KubeCon + CloudNativeCon Europe 2022
• 04mSecurely Bridging Cloud-Native and Traditional Workloads...Daniel Feldman · KubeCon + CloudNativeCon Europe 2021