This module teaches the SPIFFE specification and its production implementation SPIRE. If you have already taken our dedicated Mastering SPIFFE & SPIRE course, this module serves as a recap within the broader cloud-native security context.
SPIFFE in 5 Minutes
SPIFFE (Secure Production Identity Framework For Everyone) defines a standard for workload identity. SPIRE (SPIFFE Runtime Environment) implements it. Together they give every service a cryptographic identity — automatically issued, automatically rotated, cryptographically verifiable.
Key Concepts
- Trust Domain: The root of trust (e.g., spiffe://company.org)
- SPIFFE ID: URI identifying a workload (spiffe://company.org/ns/prod/sa/api)
- X.509-SVID: Certificate proving identity — used for mTLS
- JWT-SVID: Token proving identity — used for HTTP APIs
- Workload API: Unix socket where pods request their identity
SPIRE on Kubernetes
SPIRE Server runs as a StatefulSet. SPIRE Agent runs as a DaemonSet on every node. The Controller Manager auto-registers workloads. The CSI Driver mounts the Workload API socket into pods. The result: every pod gets a cryptographic identity with zero manual configuration.
Why SPIFFE Matters for This Course
SPIFFE is the identity layer that enables everything in subsequent modules: Envoy mTLS (Module 7), OPA authorization (Module 8), Vault integration (Module 9), and production federation (Module 14). Without workload identity, none of these integrations work.