SPIFFE
SPIFFE is a set of standards for giving software workloads cryptographically verifiable identities. It lets services authenticate across changing hosts, clusters, and clouds without treating a network address or a long-lived shared secret as the workload's identity.
itCloud native tools and technologies | OpenSkills.info
Intro
SPIFFE
Modern workloads move. A service may run in a container today, on another node tomorrow, and in another cloud during a migration. An IP address describes a network location. It does not reliably say which workload is using that location.
SPIFFE, the Secure Production Identity Framework for Everyone, defines a common way to name workloads and prove those names cryptographically. It is a set of standards, not a single product. The standards separate three concerns:
- A SPIFFE ID names a workload.
- A SPIFFE Verifiable Identity Document, or SVID, lets the workload prove that identity.
- The Workload API delivers SVIDs and trust bundles to the workload.
This separation gives applications and infrastructure a shared identity vocabulary across heterogeneous environments.
The identity model
A SPIFFE ID is a URI such as spiffe://prod.example.com/payments/api. The authority portion, prod.example.com, is the trust domain. It identifies the system that issues and validates identities. The path is an operator-defined workload identifier.
The path can describe a service, namespace, service account, or another local convention. SPIFFE defines its syntax but does not assign business meaning to the path. Authorization policy must interpret the ID according to your organization's identity design.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://spiffe.io/
Supports
- SPIFFE as open standards for workload identity
- SPIRE as a production-ready implementation
- https://spiffe.io/docs/latest/spiffe-about/overview/
Supports
- Workload identity problem in dynamic and heterogeneous environments
- High-level SPIFFE purpose and architecture
- https://spiffe.io/docs/latest/spiffe/concepts/
Supports
- Definitions of workload, SPIFFE ID, trust domain, SVID, trust bundle, and Workload API
- X.509-SVID and JWT-SVID uses and JWT replay caution
- Trust-domain separation guidance
- https://spiffe.io/docs/latest/spiffe-specs/spiffe/
Supports
- SPIFFE ID, SVID, and Workload API as the major standard components
- Local Workload API delivery and out-of-band caller identification
- Delivery of SVIDs and trust bundles
- https://spiffe.io/docs/latest/spiffe-specs/spiffe-id/
Supports
- SPIFFE ID URI structure and syntax
- Trust-domain and path rules
- SVID definition and trust-domain signing requirement
- https://spiffe.io/docs/latest/spiffe-specs/x509-svid/
Supports
- Exactly one SPIFFE ID in one URI Subject Alternative Name
- Leaf and signing certificate roles
- X.509-SVID validation and TLS use
- https://spiffe.io/docs/latest/spiffe-specs/jwt-svid/
Supports
- Required subject, audience, and expiration claims
- Supported-algorithm validation
- Bearer-token replay and transport risks
- Narrow-audience and short-validity guidance
- https://spiffe.io/docs/latest/spiffe-specs/spiffe_workload_api/
Supports
- X.509-SVID, JWT-SVID, and trust-bundle retrieval
- Local caller identification requirements
- Streaming updates and federated bundles
- Trust-domain-specific bundle selection
- https://spiffe.io/docs/latest/spiffe-specs/spiffe_federation/
Supports
- Cross-domain authentication through bundle exchange
- Directional federation relationships
- Bundle endpoint configuration and lifecycle
- Requirement to preserve each trust-domain-to-bundle binding
- https://spiffe.io/docs/latest/spire-about/spire-concepts/
Supports
- SPIRE as a production-ready SPIFFE implementation
- Server, agent, registration, selector, and attestation concepts
- https://spiffe.io/docs/latest/deploying/configuring/
Supports
- Difference between node and workload attestation
- Platform properties available as workload selectors
- https://spiffe.io/docs/latest/deploying/registering/
Supports
- Registration entry fields
- Selector matching and SVID assignment
- Parent identity and workload property requirements
- https://github.com/sindresorhus/awesome
Supports
- Starting index used to discover topic-specific curated lists
- https://github.com/spiffe/awesome-spiffe
Supports
- Curated discovery of go-spiffe, java-spiffe, and py-spiffe
- Classification of SPIFFE libraries and SPIFFE-aware software
- https://pkg.go.dev/github.com/spiffe/go-spiffe/v2
Supports
- Go SDK packages for Workload API access, identity sources, and SPIFFE-aware TLS
- https://github.com/spiffe/java-spiffe
Supports
- Java library support for X.509-SVIDs, JWT-SVIDs, trust bundles, and TLS
- https://github.com/HewlettPackard/py-spiffe
Supports
- Python library support for Workload API access, SVIDs, bundles, and TLS