SPIFFE: In Theory and in Practice

on YouTube ↗36m

" summary

SPIFFE provides a platform-agnostic workload identity: workloads get cryptographically verifiable SVIDs (supported types X.509 and JWT SVIDs) via a node-local, unauthenticated workload API that handles rotation and key distribution. Ids are URIs scoped by a trust domain bundle; bundles expose JWKS-like endpoints so systems enable federation via HTTPS and validate cross-domain mTLS. Authorization is explicitly out of scope; expect to build policy on top. Implementations like SPIRE do the plumbing and Envoy already supports SPIFFE validation.

AI-written summary · about

" chapters (8)

1. 0:00Introduction
2. 1:22Agenda
3. 2:32Vision
4. 5:13SPIFFE Specification
5. 9:36SPIFFE Overview
6. 16:08SPIFFE ID
7. 18:02Naming
8. 27:14Trust Domains

" related talks

• 36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]Evan Gilman · KubeCon + CloudNativeCon North America 2017
• 41mSPIFFE Project IntroAndrew Jessup, Emiliano Berenbaum · KubeCon + CloudNativeCon Europe 2018
• 49mReal World SPIFFE Scenarios and OutcomesAndres Vega, Frederick Kautz · KubeCon + CloudNativeCon Europe 2022
• 33mSPIFFE and SPIRE: Architecture Deep DiveEvan Gilman, Andrew Harding · Production Identity Day: SPIFFE + SPIRE 2020
• 30mIntro: SPIFFEEmiliano Bernbaum, Scott Emmons · KubeCon + CloudNativeCon Europe 2019
• 36mFederated Identity for Distributed Systems: Understanding SPIFFELeon Krass · ContainerDays Hamburg 2026
• 37mSPIFFE Deep DiveNeel Shah, Andrew Jessup, Emiliano Berenbaum · KubeCon + CloudNativeCon Europe 2018
• 33mUniform Workload Identity Everywhere: SPIRE Integrations and ExtensibilityRyan Turner · KubeCon + CloudNativeCon North America 2020 Virtual