Securing Edge Workloads With Cert-Manager And SPIFFE
summary
Shows a working system that issues unique X.509 identities per workload using cert-manager, a SPIFFE CSI driver, trust-manager and a policy approver. Demo runs on a k3s Raspberry Pi edge cluster and a 6‑node GKE cloud cluster, issues an intermediate CA, syncs trust bundles across clusters, proves mTLS connections succeed, then revokes a client by removing its CA and breaks authentication. Concrete tools, configs and a live revoke test are provided.
AI-written summary · about
chapters (26)
- 0:00Securing edge workloads
- 1:30Workload identity challenges
- 3:37Unique identity for workloads
- 5:20SPIFFE basics
- 7:05Workloads and SPIFFE IDs
- 8:50Trust domains and verification
- 10:15Trust bundles and cross-cluster
- 11:17Automating SPIFFE identity
- 11:59Cert-manager for TLS
- 13:03Cert-manager incubation
- 13:25Cert-manager add-ons
- 14:26Trust-manager for trust
- 15:08SPIFFE compliance policy
- 16:53Cert-manager + SPIFFE
- 21:48Workload security components
- 22:10Demo architecture
- 22:31Edge and cloud clusters
- 25:25Intermediate certs for demo
- 26:48CSI SPIFFE driver deployment
- 28:36Client setup and trust bundle
- 29:24Testing mutual TLS
- 30:30Revoking trust bundles
- 32:21Summary and resources
- 33:45Q&A: cert-manager & mesh
- 35:33Q&A: multi-cluster support
- 38:24Closing remarks
related talks
40mMulti-Cloud Workload Identity With SPIFFE
36mFederated Identity for Distributed Systems: Understanding SPIFFE
36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
29mBridging the Great Divide: SPIFFE/SPIRE for Cross-Cluster Authentication
32mA Platform-Agnostic Approach to Securing Workloads
37mSPIFFE Deep Dive
27mBridging Trust Between Multi-Cluster Meshes