SPIRE
SPIRE is software that gives workloads verifiable identities based on where and how they run. It operates SPIFFE identity infrastructure through servers and node agents, so applications can receive short-lived credentials without storing a shared bootstrap secret.
itCloud native tools and technologies | OpenSkills.info
Intro
SPIRE
A workload needs an identity before another service can authenticate it. Hostnames and IP addresses identify network locations, but workloads move between nodes and platforms. Long-lived secrets are difficult to distribute, protect, and rotate across those changing locations.
SPIRE solves the identity issuance problem. It is a production-ready implementation of the SPIFFE APIs. SPIRE attests nodes and workload processes, assigns registered SPIFFE IDs, and delivers short-lived SPIFFE Verifiable Identity Documents, or SVIDs.
SPIRE does not replace the SPIFFE standards. SPIFFE defines the identity model and APIs. SPIRE runs the infrastructure that applies that model to workloads.
The operating model
A SPIRE deployment contains a SPIRE Server and one or more SPIRE Agents.
The SPIRE Server is the trust authority for its configured trust domain. It stores registration entries and signing keys. It authenticates agents through node attestation and signs SVIDs for workloads that satisfy registration policy.
A SPIRE Agent runs on each node that hosts identified workloads. It proves the node's identity to the server, obtains the registration entries authorized for that node, and caches workload SVIDs. It also exposes the local SPIFFE Workload API.
This separation keeps centralized policy and signing responsibilities on the server while placing workload discovery and credential delivery near each workload.
Two attestation decisions
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://spiffe.io/docs/latest/spire-about/
Supports
- Current SPIRE documentation release context
- Official documentation path for SPIRE architecture and fundamentals
- https://spiffe.io/docs/latest/spire-about/spire-concepts/
Supports
- SPIRE as a production-ready SPIFFE implementation
- SPIRE Server and SPIRE Agent responsibilities
- Node and workload attestation sequence
- Registration entries, selectors, authorized entries, and cached SVID delivery
- Plugin roles and supported attestation evidence
- https://spiffe.io/docs/latest/spiffe/concepts/
Supports
- SPIFFE ID, SVID, trust domain, trust bundle, and Workload API terminology
- X.509-SVID and JWT-SVID purposes
- Authentication and authorization separation
- https://spiffe.io/docs/latest/deploying/
Supports
- Official progression through installation, configuration, registration, SVID use, APIs, and telemetry
- Reference-path rationale for deployment guidance
- https://spiffe.io/docs/latest/deploying/configuring/
Supports
- Server and agent configuration files and restart behavior
- SQLite default and production datastore considerations
- Key storage strategies
- Supported telemetry collectors
- https://spiffe.io/docs/latest/deploying/registering/
Supports
- Registration entry fields
- Parent identity, selectors, and workload identity assignment
- Agent caching of authorized entries
- Workload selector matching
- https://spiffe.io/docs/latest/deploying/spire_server/
Supports
- Server plugin types and responsibilities
- SQL datastore, key manager, upstream authority, and bundle publisher options
- Audit logging and health-check configuration
- Server administration and validation references
- https://spiffe.io/docs/latest/deploying/spire_agent/
Supports
- Agent plugin types and configuration
- Workload API and health behavior
- Agent telemetry reference
- https://spiffe.io/docs/latest/planning/scaling_spire/
Supports
- Single-server availability limit
- Horizontal server scaling with a shared datastore
- Registration count, JWT use, and agent synchronization as sizing factors
- Single-domain, nested, and federated topology distinctions
- https://spiffe.io/docs/latest/architecture/
Supports
- Nested and federated SPIRE deployment options
- Architecture reference-path rationale
- https://spiffe.io/docs/latest/deploying/telemetry_config/
Supports
- Server and agent metric export
- Prometheus, StatsD, DogStatsD, M3, and in-memory collectors
- Telemetry reference-path rationale
- https://github.com/sindresorhus/awesome
Supports
- Starting index used to discover a topic-specific awesome list
- https://github.com/spiffe/awesome-spiffe
Supports
- Curated discovery of go-spiffe, Envoy, and Istio
- Classification of SPIFFE libraries, SPIFFE-aware software, and SPIRE integrations
- https://pkg.go.dev/github.com/spiffe/go-spiffe/v2/examples/spiffe-tls
Supports
- Go mutual TLS example using Workload API identity sources
- Explicit peer SPIFFE ID authorization
- Automatic X.509-SVID renewal through go-spiffe
- https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto.html
Supports
- Envoy SPIFFE certificate validator configuration
- Separate trust bundles per trust domain
- URI identity matching and dynamic bundle-file updates
- https://istio.io/latest/docs/ops/integrations/spire/
Supports
- SPIRE identity delivery to Envoy through the Secret Discovery Service
- Manual and controller-managed workload registration
- SPIFFE federation integration