Production Identity Day: SPIFFE + SPIRE 2020
2020-11-17
-- online --
as the organisers put it
A place to share learnings around the latest developments, exhibit demos, and discuss real-world use cases with others who share an interest in identity, authentication, and zero trust security.
who it's for
platform engineers, security engineers, site reliability engineers, devops engineers, kubernetes operators, backend engineers, open-source contributors
topics
SPIFFE Workload API and agents; SPIRE node attestation with TPM; JWT-SVID minting and custom JOSE; X.509 SVID issuance and rotation; SPIRE federation specification; Envoy mutual TLS integration with SPIFFE; SPIRE Kubernetes CRD integration; Open Policy Agent authorization checks; Go SPIFFE client library v2; SPIRE key manager plugins (KMS, TPM); Intel SGX attestation and provisioning
| title | author | length |
|---|---|---|
| Welcome | Andres Vega, Umair Khan | 02m |
A brief opener states that SPIFFE and SPIRE provide a universal identity plane for distributed systems and that the projects are CNCF incubating, backing the… | ||
| Keynote: Introduction to SPIFFE | Kelsey Hightower | 26m |
Demo shows SPIFFE IDs as simple strings embedded in tokens and certificates and proves end-to-end that they can bootstrap trust across clouds. A Cloud Run… | ||
| SPIFFE Project Updates | Evan Gilman | 15m |
Project governance gets concrete: a rewritten TSC charter defines responsibilities and will trigger a composition review; two new working groups (sig community… | ||
| SPIRE Project Updates | Agustín Martínez Fayó | 19m |
Seven releases since last KubeCon deliver more than 20 features, about 40 bug fixes, and 230 merged PRs from 36 contributors. The project refactors the server… | ||
| Community Integrations and other Works in Progress | Umair Khan | 31m |
SPIRE is shown replacing Istio’s identity issuance by rerouting the proxy sidecar to the SPIRE node agent over a Unix domain socket and merging small SPIRE… | ||
| SPIFFE and SPIRE: Architecture Deep Dive | Andrew Harding, Evan Gilman | 33m |
SPIRE implements the SPIFFE Workload API with an agent/server model: agents cache SVIDs and bundles, servers hold X.509 and JWT authorities and offload private… | ||
| Securing Kafka with SPIFFE at TransferWise | Jonathan Oddy, Levani Kokhreidze | 20m |
TransferWise replaces long‑lived Kafka certs with SPIFFE/SPIRE-issued SVIDs and Envoy sidecars to get mutual TLS without touching client code, rolling this out… | ||
| “Solving the Bottom Turtle”: Writing a book on SPIFFE in 10 days using Book Sprints | Barbara Ruehling | 08m |
A book on SPIFFE gets produced in a 10-day virtual sprint with 12 writers, real-time copy editing and layout, and a final product of 200 pages and 80 diagrams… | ||
| Using SPIRE in Production at Uber | Andrew Moore | 16m |
Deployment spans dozen data centers with under 10 SPIRE servers per DC, a dedicated agent on every host, and tens of millions of x509 signings per day. A… | ||
| SPIFFE at GitHub | Eric Lee | 26m |
GitHub runs SPIRE in production for a year to deliver SPIFFE identities across on‑prem and multi‑cloud infrastructure, replacing bespoke auth. Agents run as… | ||
| Passport App: The role of SPIFFE and SPIRE in a return to work solution | Frederick Kautz | 20m |
A return-to-work Passport app is built that generates a cryptographically signed QR attestation and runs health questionnaires and policy checks entirely on… | ||
| Making Your First Contribution to SPIRE (optional session) | Ryan Turner | 06m |
Start by scanning GitHub for the community good first issue tag or open an issue describing the exact deployment gap; maintainers monitor issues weekly. Follow… | ||
| 10 Lessons From Migrating to SPIFFE After 10 Years Of Service Identity at Square | Mat Byczkowski | 26m |
Square deploys SPIRE servers on-prem with an agent on each host, builds a custom workload registrar, and registers identities for over a thousand services so… | ||
| Using a CRD to better integrate SPIRE and Kubernetes | Faisal Memon | 16m |
A Kubernetes CustomResourceDefinition translates YAML into SPIRE registration entries so kubectl can create, edit and delete SVIDs; the registrar runs as a… | ||
| Fortifying Microservice Security with SPIRE and OPA | Ash Nakar | 17m |
SPIRE issues workload identities as SPIRE-issued JWT SVIDs via OIDC Federation and OPA decodes and validates those tokens (using the JWKS URI) to make… | ||
| Using DevIDs and TPMs for Node Attestation | Adriane Cardozo, Marcos Yedro | 14m |
Proposal implements a TPM Node Attestor plugin for SPIRE that follows the TCG draft and 802.1AR, using TPM 2.0-protected DevID certificates whose private keys… | ||
| Attestation and identity provisioning to Intel SGX workloads | Andrey Brito | 19m |
Integration proves identities can reflect running code and filesystem state by using an SGX Attestor plus SPIRE to mint x509 SVID certificates bound to a… | ||
| nothing matches | ||