SPIFFE at GitHub
Talkat Production Identity Day: SPIFFE + SPIRE 2020 · on Tuesday, 2020-11-17· at 14:20· Virtual, Virtual·
summary
GitHub runs SPIRE in production for a year to deliver SPIFFE identities across on‑prem and multi‑cloud infrastructure, replacing bespoke auth. Agents run as systemd agents instead of Kubernetes DaemonSets; workloads get the agent via a domain socket mount in pod volumes. A custom node resolver unpacks the machine cert common name and queries an internal registry (packaged as an OS plugin) so x509 CN→registry plugin yields extra selectors for registration entries, cutting onboarding work and clarifying blast radii.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:31Agenda Motivation
- 1:41Motivation Make a single standard of identity between workloads a utility for teams
- 4:09A Layered Approach
- 6:23SPIRE Setup: Take One
- 7:03DaemonSet Issues Availability - Daemon Set Pods are terminated before replacements scheduled Race Conditions - Pod creation is unordered per Kube Node Dual Maintenance
- 9:06SPIRE Setup: Take Two Reprovision SPIRE as a Systemd Unit - Availability
- 10:46Exposing The Agent To Pods
- 12:29Generating Custom Node Selectors
- 14:23The x509Pop NodeAttestor SPIRE Server Config Snippet
- 16:00Custom NodeResolver Plugin
- 17:47Custom Selectors
related talks
41mSPIFFE Project Intro
30mIntro: SPIFFE
49mReal World SPIFFE Scenarios and Outcomes
34mScaling SPIRE for Performance and Availability
34mSecuring Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIRE
37mSPIFFE Deep Dive
36mIntroducing SPIFFE: An Open Standard for Identity in Cloud Native Environments [I]
36mFederated Identity for Distributed Systems: Understanding SPIFFE