SPIFFE & SPIRE
Status: Final
SPIFFE (Secure Production Identity Framework for Everyone) is the open standard for workload identity. SPIRE is its reference implementation. Together they provide cryptographic workload identity independent of the underlying infrastructure — relevant in zero-trust architectures and service mesh deployments.
What Problem SPIFFE Solves
In microservices, how does Service A know it is talking to Service B and not an attacker? Traditional approaches use shared secrets, IP whitelisting, or API keys — all fragile. SPIFFE issues each workload a short-lived X.509 certificate or JWT based on its identity (not its network address).
SPIFFE IDs
A SPIFFE ID is a URI that uniquely identifies a workload:
spiffe://trust-domain/path/to/workload
spiffe://prod.example.com/service/payment-api
spiffe://cluster.local/ns/default/sa/frontend
SVID (SPIFFE Verifiable Identity Document)
An SVID is the credential — either:
- X.509-SVID: X.509 certificate with SPIFFE URI in the SAN
- JWT-SVID: JWT with SPIFFE ID as the
subclaim
SVIDs are short-lived (minutes to hours) and automatically rotated by SPIRE.
SPIRE Architecture
SPIRE Server (control plane)
├── Issues SVIDs
├── Stores registration entries (workload → SPIFFE ID mapping)
└── Manages trust bundles
SPIRE Agent (runs on each node)
├── Attests nodes to SPIRE Server
├── Receives SVIDs from Server
└── Serves SVIDs to workloads via Workload API (Unix socket)
Workloads call the Workload API: unix:///tmp/spire-agent/public/api.sock to receive their SVID.
Integration with Kubernetes
SPIRE can attest workloads using Kubernetes service account tokens — the SPIRE Agent verifies the pod's service account JWT against the Kubernetes API to confirm the workload's identity before issuing an SVID.
This is the foundation for OIDC federation: cloud providers (AWS, GCP, Azure) can trust SPIRE as an OIDC issuer, allowing workloads to receive cloud credentials without static keys.
Security Considerations
| Risk | Mitigation |
|---|---|
| SPIRE Server compromise | Full PKI compromise — treat as Tier 0 |
| Unix socket access | Only the intended workload should access the agent socket |
| Trust bundle misconfiguration | Cross-trust-domain attacks if bundle is too permissive |
| Short-lived SVIDs | Auto-rotation is the primary defense against credential theft |
Cross-Links
| Topic | Link |
|---|---|
| Kubernetes Service Accounts | k8s-service-accounts |
| PKI Overview | pki-overview |
| GCP Workload Identity | workload-identity-federation |