Module 6: Working with SVIDs and the Workload API Slides

Slide Outline

1. Working with SVIDs and the Workload API - How applications consume and use SPIFFE identities
2. Learning Objectives - 4 outcomes for this module
3. Why This Module Matters - A workload identity system is useless if applications cannot consume the identities. This module bridges the gap between
4. Integration Approaches - Lesson section from the full module
5. Using go-spiffe - Lesson section from the full module
6. Using SPIFFE Helper - Lesson section from the full module
7. Building mTLS Between Microservices - Lesson section from the full module
8. Secure gRPC Communication - Lesson section from the full module
9. Real-World Use Cases - Go microservices using go-spiffe for native mTLS, Legacy Java applications using SPIFFE Helper for zero-code integration
10. Common Mistakes to Avoid - 4 mistakes covered
11. Production Notes - 3 practical notes
12. Hands-On Labs - 3 hands-on labs
13. Key Takeaways - 5 points to remember

Learning Objectives

• Use the SPIFFE Workload API programmatically
• Integrate SPIFFE into Go, Python, and Java applications
• Build mTLS connections between microservices
• Implement automatic certificate rotation in applications

Why This Module Matters

A workload identity system is useless if applications cannot consume the identities. This module bridges the gap between infrastructure (SPIRE) and application code — the integration point where most real-world problems occur.

Production Notes

• For new services: use go-spiffe or py-spiffe for native integration. For legacy services: use SPIFFE Helper to write certs to disk with zero code changes.
• Always configure a renewal signal (SIGHUP) with SPIFFE Helper so applications reload certificates on rotation.
• In production, use the Envoy sidecar approach when you cannot modify application code and need mTLS transparently.

Common Mistakes

• Not handling SVID rotation callbacks — applications crash when certs expire
• Hardcoding socket paths instead of using the SPIFFE_ENDPOINT_SOCKET environment variable
• Using SPIFFE Helper without configuring the renew_signal — certs rotate but the app keeps using old ones
• Fetching SVIDs on every request instead of caching and watching for rotation

Key Takeaways

• SPIFFE Helper enables zero-code integration — writes certs to files
• go-spiffe provides native Workload API integration with auto-rotation
• mTLS between services requires no manual certificate management with SPIRE
• gRPC integrates natively with SPIFFE via TLS credentials
• Choose your approach: sidecar (any language), library (Go/Python/Java), or proxy (Envoy)

Hands-On Labs

1. Getting SVIDs with SPIFFE Helper

   Use SPIFFE Helper for zero-code SVID integration.

   • Deploy SPIFFE Helper as a sidecar container
   • Configure certificate file paths
   • Verify SVIDs are written to disk
   • Configure an Nginx server to use the SVID certificates

   View lab files on GitHub

2. Building mTLS Between Microservices

   Establish mutual TLS between two Go services using go-spiffe.

   • Build a Go server that serves with its SVID
   • Build a Go client that authenticates with its SVID
   • Verify mTLS connection with both identities
   • Test that a service without a valid SVID is rejected

   View lab files on GitHub

3. Secure gRPC Communication

   Secure gRPC services with SPIFFE identities.

   • Create a gRPC server with SPIFFE TLS credentials
   • Create a gRPC client with SPIFFE TLS credentials
   • Verify mutual authentication via SPIFFE IDs
   • Implement SPIFFE ID-based authorization in the server

   View lab files on GitHub