Bridging the Great Divide: SPIFFE/SPIRE for Cross-Cluster Authentication
Talkat KubeCon + CloudNativeCon North America 2021 · on Friday, 2021-10-15· at 11:55· Room 403 AB + Online·
summary
Demonstrates a Kubernetes controller that programs SPIRE to achieve automated cross-cluster authentication by declaring two CRDs: ClusterSpiffeID CRD, which maps pod selectors to SPIFFE IDs and allowed federations, and ClusterFederatedTrustDomain CRD, which contains bundle endpoints and auth profiles. Uses SPIFFE/SPIRE, the Workload API, Go SPIFFE libs and gRPC to obtain X.509 SVIDs and bundles, federate trust domains via bundle endpoints, and perform mutual TLS between a greeter client and server across two clusters — the live demo successfully shows identities exchanged and verified.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:04Problem Statement
- 1:33SPIFFE Refresher
- 6:22SPIRE Refresher
- 9:00SPIRE Controller
- 11:08Demo
- 28:02Summary
related talks
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
27mBridging Trust Between Multi-Cluster Meshes
19mFederate, Scale, and Secure: Practical SPIFFE/SPIRE for Containers...
34mScaling SPIRE for Performance and Availability
27mDeep Dive: SPIFFE
36mFederated Identity for Distributed Systems: Understanding SPIFFE
30mIntro: SPIFFE
07m⚡ Lightning Talk: Using Istio and SPIRE to Trust Cross-domain Traffic in Hybrid Cloud Scenarios